12 matches found
CVE-2018-5376
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpupload.php op parameter...
CVE-2018-5377
Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...
CVE-2018-5375
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...
CVE-2018-10298
Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post=newthread because data/template/1diyportalview.tpl.php does not restrict the content...
Design/Logic Flaw
Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...
CVE-2018-5377
Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...
CVE-2018-5377
Summary: CVE-2018-5377 affects Discuz! DiscuzX X3.4. The available records state a remote attacker can bypass intended access restrictions by supplying the archiver\index.php action parameter. The core issue is a security bypass in the archiver component that allows elevation of access control. N...
Design/Logic Flaw
Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/spacepoll.php, as demonstrated by a mod=space do=poll request to home.php...
CVE-2018-5331
Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/spacepoll.php, as demonstrated by a mod=space do=poll request to home.php...
CVE-2018-5331
Discuz! DiscuzX X3.4 is affected by a cross-site scripting (XSS) vulnerability triggered by the view parameter sent to include/space/space_poll.php, demonstrated by a mod=space do=poll request to home.php. Multiple connected sources document the issue, but none provide exploit steps or concrete r...
CVE-2018-5259
Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter...
Design/Logic Flaw
Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter...