CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

PT-2017-18307

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue allows for XSS attacks due to an array returned by HttpRequestService::getSegments and getActionSegments not being zero-based, resulting from an incomplete fix for a previous security...

CVE-2017-8384: Improper Neutralization of Input During Web Page Generation

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...