PT-2017-3297

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.27.x through 1.27.3 MediaWiki versions 1.28.x through 1.28.2 MediaWiki versions 1.29.x through 1.29.1 Description The issue is related to a Reflected File Download vulnerability in the api.php file. This vulnerability can ...

CVE-2017-14192: Improper Neutralization of Input During Web Page Generation

The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field...

PT-2017-13294

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to an XSS concern in the checktitle function, specifically in the module field within the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider disabling t...

PT-2017-13295

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the oauth function in the controllers/member/api.php file, which has an XSS vulnerability concerning the Referer HTTP header, specifically with Internet Explorer. Recommendations For...

CVE-2017-14193: Improper Neutralization of Input During Web Page Generation

The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-13697

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

PT-2017-13025

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to XSS and concerns the dirname variable in the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider restricting the use of the dirname variable in the...

CVE-2017-13697: Improper Neutralization of Input During Web Page Generation

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

Cross site scripting

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11629

FineCMS

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11629: Improper Neutralization of Input During Web Page Generation

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

PT-2017-12140

Name of the Vulnerable Software and Affected Versions FineCms versions through 5.0.10 Description The issue concerns a Cross Site Scripting XSS problem. It is located in the controllers/api.php file via the function parameter in a "c=api&m=data2" request. Recommendations For versions through...

PT-2017-17848

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.3.11 MantisBT versions 2.x prior to 2.3.3 MantisBT versions 2.4.x prior to 2.4.1 Description The issue arises from the omission of a backslash check in string api.php, leading to conflicting interpretations of an...

Design/Logic Flaw

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php...

DEBIAN-CVE-2016-6331

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php...

CVE-2016-6331

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php...

CVE-2016-6335

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php...

CVE-2016-6335

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php...