156 matches found
CVE-2014-2293
CVE-2014-2293 affects Zikula Application Framework prior to 1.3.7 build 11. The vulnerability arises from PHP object injection via crafted serialized data in index.php parameters: authentication_method_ser, authentication_info_ser, or zikulaMobileTheme. This can allow remote attackers to delete a...
CVE-2014-2293: Improper Control of Generation of Code
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the 1 authenticationmethodser or 2 authenticationinfoser parameter to index.php, or 3...
PT-2018-4194
Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11 Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code...
Zikula 'jcss.php' Directory Traversal Vulnerability
Zikula is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Zikula Directory Traversal Vulnerability
Zikula is the Zikula Foundation's set of PHP application frameworks for building and maintaining Web sites, which can be extended with third-party add-on modules into communities, portals, e-commerce, and more. A directory traversal vulnerability exists in the jcss.php file in Zikula versions 1.3...
CVE-2016-9835
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file...
Directory traversal
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file...
CVE-2016-9835
Summary (CVE-2016-9835) : Zikula’s jcss.php file has a directory traversal vulnerability in 1.3.x (before 1.3.11) and 1.4.x (before 1.4.4) on Windows, allowing a remote attacker to upload a serialized file to trigger a PHP object injection. Root cause is improper handling of uploaded content lead...
CVE-2016-9835
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file...
CVE-2016-9835
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file...
CVE-2016-9835: Improper Neutralization of Special Elements used in a Command
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file...
PT-2016-7835
Name of the Vulnerable Software and Affected Versions Zikula versions 1.3.x through 1.3.10 Zikula versions 1.4.x through 1.4.3 Description A directory traversal issue in the file "jcss.php" allows a remote attacker to launch a PHP object injection by uploading a serialized file. Recommendations F...
Zikula Application Framework 1.3.6 Multiple PHP Object Injection Vulnerabilities
Exploit for php platform in category web applications Zikula Application Framework = 1.3.6 Multiple PHP Object Injection Vulnerabilities • Software Link: http://zikula.org/ • Affected Versions: Version 1.3.6 and probably prior versions. • Vulnerabilities Description: 1 Input passed via the...
Zikula Application Framework 1.2.2 ZLanguage.php lang Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/39717/info Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code i...
Zikula CMS <= 1.2.4 CSRF Vulnerability
No description provided by source. Source: http://packetstormsecurity.org/files/view/98060/zikulacms-xsrf.txt ==================================================== Zikula CMS 1.2.4 = Cross Site Request Forgery CSRF Vulnerability ==================================================== 1. OVERVIEW The...
Zikula Application Framework 1.2.2 index.php func Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/39717/info Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code i...
Zikula CMS 1.3.5 - Multiple Vulnerabilities
No description provided by source. Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...
Cross-Site Scripting (XSS) in Zikula Application Framework
Advisory ID: HTB23178 Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Versions: 1.3.5 build 20 and probably prior Tested Version: 1.3.5 build 20 Advisory Publication: October 16, 2013 without technical details Vendor Notification: October 16, 2013 Vendor Patch:...
Zikula returnpage Cross Site Scripting Vulnerability
Zikula is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Zikula 1.3.5 Build 20 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Versions: 1.3.5 build 20 and probably prior Tested Version: 1.3.5 build 20 Advisory Publication: October 16, 2013 without technical details Vendor Notification...