382 matches found
CVE-2017-7881
BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...
CVE-2017-7881: Cross-Site Request Forgery (CSRF)
BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...
PT-2017-17970
Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.18 Description The issue allows remote attackers to bypass CSRF protection by manipulating the HTTP Referer header. This is due to the reliance on a substring check for CSRF protection, which can be exploited ...
Fastspot BigTree CMS Arbitrary File Upload Vulnerability
Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An arbitrary file upload vulnerability exists in Fastspot BigTree CMS versions prior to 4.2.17. An attacker can bypass security checks and execute arbitrary code by uploadi...
Unrestricted file upload
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
CVE-2017-7695
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
CVE-2017-7695
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
CVE-2017-7695
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
CVE-2017-7695
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
CVE-2017-7695
BigTree CMS
PT-2017-17893
Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.17 Description The issue allows for Unrestricted File Upload, enabling an attacker to bypass safety checks by uploading a file named 'xxx.phpspace'. This could lead to the execution of arbitrary code...
CVE-2017-7695: Unrestricted Upload of File with Dangerous Type
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...
BigTree CMS Multiple CSRF Vulnerabilities
BigTree CMS is prone to multiple CSRF vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bigtreecms:bigtreecms";...
Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability
Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.2.16. An attacker can exploit this vulnerability to perform unauthorized operations...
Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-03387)
Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.1.18. An attacker can exploit this vulnerability to perform unauthorized operations with...
Cross site request forgery (csrf)
CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...
CVE-2017-6914
CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted...
Cross site request forgery (csrf)
CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted...