76 matches found
CVE-2008-7243
MODx CMS 0.9.6.1 and 0.9.6.1p1 are affected by a CSRF vulnerability (CVE-2008-7243) that allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. Technical details are limited in the provided documents; the description specifies...
CVE-2008-7242
CVE-2008-7242: Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allow remote attackers to inject arbitrary web script or HTML via a set of parameters (search, a, messagesubject, messagebody on certain pages; highlight, id, email, name, parent on index.php; doc...
CVE-2008-7243
Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...
CVE-2008-5939
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
Remote file inclusion
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
CVE-2008-5938
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...
CVE-2008-5939
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
CVE-2008-5938
The vulnerability CVE-2008-5938 affects MODx CMS ≤ 0.9.6.2, where PHP remote file inclusion is possible through assets/snippets/reflect/snippet.reflect.php via the reflect_base parameter when magic_quotes_gpc is disabled. This could allow an attacker to execute arbitrary PHP code on the server. C...
CVE-2008-5939
MODx CMS before 0.9.6.3 is affected by XSS in index.php (and related to username input) allowing remote attackers to inject arbitrary script/HTML. CVE-2008-5942 also notes vectors tied to the preserveUrls function. The original disclosure indicates the id parameter is unlikely affected. Remediati...
MODx CMS 0.9.6.2 - Remote File Inclusion Cross-Site Scripting
MODx CMS 0.9.6.2 - Remote File Inclusion Cross-Site Scripting :: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor:...
MODx CMS <= 0.9.6.2 (RFI/XSS) Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ============================================================= MODx CMS = 0.9.6.2 RFI/XSS Multiple Remote Vulnerabilities ============================================================= :: The Codes Like A Game Anyone Can Play With It,s ::...
MODx CMS <= 0.9.6.2 (RFI/XSS) Multiple Remote Vulnerabilities
No description provided by source. :: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor:...
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
:: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor: http://modxcms.com/assets/snippets/filedownload/download.php?path=YnVpbGRz&fileName=modx-0.9.6.2.tar.gz&utmsource=0961p2&utmmedium=web&utmcampaign=download Discover by :...
MODX CMS < 0.9.2.2 RFI Vulnerability - Active Check
MODX CMS is prone to a remote file inclusion RFI vulnerability. SPDX-FileCopyrightText: 2008 Justin Seitz Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Vulnerability in MODx CMS
Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в MODx CMS. Уязвимость в скрипте index.php в параметре email. XSS: http://site/index.php?operation=subscribe&id=39&email=3CBODY20onload=alertdocument.cookie3E Уязвима прошлогодняя версия MODx CMS и вполне возможно,...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. MODx CMS: index.php crossite scripting through email parameter...
DSECRG-08-013.txt
Digital Security Research Group DSecRG Advisory DSECRG-08-013 Application: MODx CMS Versions Affected: 0.9.6.1, 0.9.6.1p1 Vendor URL: http://modxcms.com/ Bugs: XSS, SiXSS, stored XSS, Change User Password XSRF Vulnerability. Exploits: YES Reported: 11.01.2008 Vendor response: 11.01.2008 Updated...
[DSECRG-08-013] Modx 0.9.6.1, 0.9.6.1p1 Multiple Security Vulnerabilities
Digital Security Research Group DSecRG Advisory DSECRG-08-013 Application: MODx CMS Versions Affected: 0.9.6.1, 0.9.6.1p1 Vendor URL: http://modxcms.com/ Bugs: XSS, SiXSS, stored XSS, Change User Password XSRF Vulnerability. Exploits: YES Reported: 11.01.2008 Vendor response: 11.01.2008 Updated...
MODx CMS 0.9.6.1 Multiple Remote Vulnerabilities
No description provided by source. WwW.BugReport.ir AmnPardaz Security Research Team Title: MODx CMS Vulnerabilities Vendor: http://modxcms.com Bugs: Source code disclosure, local file inclusion Vulnerable Version: 0.9.6.1 prior versions also may be affected Exploitation: Remote with browser...