1992 matches found
CVE-2017-8384: Improper Neutralization of Input During Web Page Generation
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8383: Undefined Security Weakness
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
PT-2017-18306
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue is related to improper restriction of viewing the contents of files in the craft/app/ folder. This could potentially allow unauthorized access to sensitive information. Recommendations...
Craft CMS Cross-Site Scripting Vulnerability
Craft CMS is a content management system CMS developed by Craft. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2974. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
Cross site scripting
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
CVE-2017-8052 affects Craft CMS prior to 2.6.2974, enabling XSS. The vulnerability arises in Craft’s handling of user-supplied input; the initial entry assigns a MEDIUM base CVSS (6.1) on CVSS3, with network vector and user interaction required. Public references tie the issue to an incomplete fi...
PT-2017-18092
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2974 Description The issue allows for XSS attacks. Recommendations For versions prior to 2.6.2974, update to version 2.6.2974 or later to resolve the issue...