Cross site scripting

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

Default credentials

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8385

CVE-2017-8385 affects Craft CMS prior to 2.6.2976. The vulnerability is that the forgot-password email URL can be modified by an attacker, indicating a URL forgery/URL tampering issue within the password-reset flow. The available documented impact is the ability to alter the reset URL, with no ex...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

CVE-2017-8383

Craft CMS prior to 2.6.2976 contains an information-disclosure vulnerability where access to files under the craft/app/ directory is not properly restricted. The issue allows potential exposure of sensitive information. Root cause is insufficient access controls within the affected file path. Aff...

CVE-2017-8384

Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...

PT-2017-18306

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue is related to improper restriction of viewing the contents of files in the craft/app/ folder. This could potentially allow unauthorized access to sensitive information. Recommendations...

PT-2017-18307

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue allows for XSS attacks due to an array returned by HttpRequestService::getSegments and getActionSegments not being zero-based, resulting from an incomplete fix for a previous security...

PT-2017-18308

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue allows modification of the URL in a forgot-password email message. Recommendations For versions prior to 2.6.2976, update to version 2.6.2976 or later to resolve the issue...