CVE-2007-4365

Cross-site scripting XSS vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a setlang cookie to an unspecified component. NOTE: this may overlap CVE-2007-1965...

CVE-2007-4365

CVE-2007-4365 is an XSS vulnerability affecting eXV2 CMS 2.0.5 and earlier. The flaw allows remote attackers to inject arbitrary script/HTML via a set_lang cookie to an unspecified component. Connected records also reference CVE-2007-1965 as a possible overlap. The available documents confirm the...

CVE-2007-4365

Cross-site scripting XSS vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a setlang cookie to an unspecified component. NOTE: this may overlap CVE-2007-1965...

eXV2.de Browser Cookie is not properly sanitised

Details ======= Product: eXV2.de CMS = 2.0.5. Severity: moderated Remote-Exploit: yes Vendor-URL: http://www.exv2.de/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: Vision aka n-tier http://www.i-s-o.org Original Advisory: ============...

CVE-2007-1966

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

CVE-2007-1965

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the setlang parameter to 1 archive.php, 2 article.php, 3 index.php, or 4 topics.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the setlang parameter to 1 archive.php, 2 article.php, 3 index.php, or 4 topics.php...

CVE-2007-1965

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the setlang parameter to 1 archive.php, 2 article.php, 3 index.php, or 4 topics.php...

Session fixation

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

CVE-2007-1966

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

CVE-2007-1965

CVE-2007-1965 describes multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS versions up to 2.0.4.3 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the set_lang parameter to (1) archive.php, (2) article.php, (3) index.php, or (4) topics.php. Ex...

CVE-2007-1966

CVE-2007-1966 affects eXV2 CMS up to version 2.0.4.3. It describes a session fixation flaw that allows a remote attacker to hijack a user session by setting the PHPSESSID cookie. The impact is noted as high for confidentiality and integrity (no availability impact). No explicit exploit details or...

CVE-2007-1965

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the setlang parameter to 1 archive.php, 2 article.php, 3 index.php, or 4 topics.php...

CVE-2007-1966

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie...

[MajorSecurity Advisory #38]eXV2 CMS - Session fixation and Cross-Site-Scripting Issues

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

CVE-2006-7080

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the oldavatar parameter...

CVE-2006-7080

Summary: CVE-2006-7080 affects exV2 versions up to 2.0.4.3, where the avatar upload feature is vulnerable to a directory traversal via the old_avatar parameter. Attacker-controlled ".." sequences can be used to delete arbitrary files on the server. The vulnerability is categorized with a CVSS v2 ...

CVE-2006-7079

CVE-2006-7079 affects exV2 versions 2.0.4.3 and earlier, in include/common.php. The issue allows remote attackers to overwrite arbitrary program variables and perform directory traversal to execute arbitrary code by modifying xoopsOption['pagetype']. The initial docs provide CVSS data: CVSS v2 ba...

CVE-2006-7080

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the oldavatar parameter...

CVE-2006-7079

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption'pagetype' variable...