CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...

CVE-2018-19135

Summary of CVE-2018-19135 (ClipperCMS 1.3.3): ClipperCMS 1.3.3 is vulnerable to a Cross-Site Request Forgery (CSRF) in the kcfinder file upload feature, which is enabled by default. The vulnerability allows an attacker to perform actions on behalf of an admin (or any user with file upload capabil...

CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...

ClipperCMS Cross-Site Scripting Vulnerability (CNVD-2018-13274)

ClipperCMS is a content management system CMS. A cross-site scripting vulnerability exists in ClipperCMS version 1.3.3. The vulnerability can be exploited by remote attackers to inject/store malicious scripts and execute them via the Full Name field of the Security - Manager Users or Security - W...

Cross site scripting

ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...

CVE-2018-13998

ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...

CVE-2018-13998

ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...

CVE-2018-13998

ClipperCMS 1.3.3 contains a stored XSS flaw in the Full Name field leveraged from the Security → Manager Users or Security → Web Users interfaces. The root cause is unvalidated/sanitized input stored and later rendered in a context where scripts execute. Impact is user-protection risk through scr...

CVE-2018-13998

ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...

CVE-2018-13106

ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...

Cross site scripting

ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...

CVE-2018-13106

ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...

CVE-2018-13106

ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...

CVE-2018-13106

ClipperCMS 1.3.3 is affected by a stored XSS vulnerability in the manager/ Tools → Configuration screen (via the manager/ URI). The issue originates from input that is stored and later rendered unsafely. No remediation or patch details are provided in the connected sources; the CVE entry document...

CVE-2018-11571

ClipperCMS 1.3.3 allows Session Fixation...

CVE-2018-11572

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

Session fixation

ClipperCMS 1.3.3 allows Session Fixation...

Design/Logic Flaw

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

CVE-2018-11571

ClipperCMS 1.3.3 allows Session Fixation...

CVE-2018-11572

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...