PT-2014-4471

Name of the Vulnerable Software and Affected Versions ModX Revolution versions prior to 2.2.11 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the a parameter in the manager/templates/default/header.tpl file. Recommendations For...

CVE-2014-2080: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

MODx Evogallery模块'uploadify.php'任意文件上传漏洞

Bugtraq ID:65646 MODx是一个开源的PHP应用框架,可以帮助使用者控制自己的网上内容。 MODx Evogallery模块'uploadify.php'不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交恶意文件，并以WEB权限执行。 0 MODx Evogallery 用户可参考厂商的GIT库以获得补丁修复此漏洞： https://github.com/Mark-H/EvoGallery ?php $uploadfile="file.php"; $ch =...

MODx Evogallery Shell Upload

Author: TUNISIAN CYBER + Exploit Title: MODx Evogallery File Upload Vulnerability + Date: 18-02-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + Vendor: http://modx.com/extras/package/evogallery + Friendly Sites: na3il.com,th3-creative.com 1.OVERVIEW: MODx's module Evogallery...

MODx Evogallery Module - Uploadify.php Arbitrary File Upload

MODx Evogallery Module - Uploadify.php Arbitrary File Upload source: https://www.securityfocus.com/bid/65646/info MODx Evogallery module is prone to an arbitrary file upload vulnerability. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in...

MODx (Evogallery) File Upload Vulnerability

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Exploit Title: MODx Evogallery File Upload Vulnerability + Date: 18-02-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + Vendor: http://modx.com/extras/package/evogallery + Friendly Sites:...

MODX CMS < 2.3.0 XSS Vulnerability - Active Check

MODX CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SOJOBO-ADV-13-02] - MODx 2.2.10 Reflected Cross Site Scripting

SOJOBO-ADV-13-02 - MODx 2.2.10 Reflected Cross Site Scripting I. Information ================== Name : MODx 2.2.10 Reflected Cross Site Scripting Software : MODx 2.2.10 and possibly below. Vendor Homepage : http://modx.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity : Low 2/5...

MODx 2.2.10 Cross Site Scripting

SOJOBO-ADV-13-02 - MODx 2.2.10 Reflected Cross Site Scripting I. Information ================== Name : MODx 2.2.10 Reflected Cross Site Scripting Software : MODx 2.2.10 and possibly below. Vendor Homepage : http://modx.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity : Low 2/5...

Vulnerabilities in multiple web applications with GDD FLVPlayer

Hello 3APA3A! These are Content Spoofing and Cross-Site Scripting vulnerabilities in multiple web applications with GDD FLVPlayer. Earlier I've wrote about vulnerabilities in GDD FLVPlayer http://seclists.org/fulldisclosure/2013/Aug/247. This is video and audio player, which is used at thousands...

Security Bypass and Remote Execution

Product: MODX Revolution Severity: Extremely Critical Versions: 2.1.0–2.2.7 Vulnerability type: Security Bypass Report date: 2013-Jun-4 Fixed date: 2013-Jun-4 Description Two vulnerabilities were discovered in MODX that allow users to bypass security. Attackers could exploit this to remotely...

New vulnerabilities in MODx Revolution

Hello 3APA3A! I want to warn you about two new vulnerabilities in MODx Revolution. This is addition to previous publication about vulnerabilities in MODx Revolution http://securityvulns.ru/docs28923.html. These are Abuse of Functionality vulnerabilities in MODx related to earlier mentioned Brute...

MODX Evolution 1.0.7 (and prior) ForgotManager plugin Vulnerability

Product: MODX Evolution Risk: Very High Severity: Critical Versions: 1.0.7 Vulnerabilty Type: Permissions, Privileges, and Access Control; Input Validation; SQL Injection Report Date: 2013-Jan-4 Fixed Date: 2013-Jan-8 Description The Forgot Manager Login plugin distributed with all versions of MO...

BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution

Hello 3APA3A! I want to warn you about multiple vulnerabilities in MODx Revolution. These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x Revolution versions of MODx. In 0.x and 1.x Evolution versions of...

BF and FPD vulnerabilities in MODx

Hello 3APA3A! I want to warn you about security vulnerabilities in MODx. This is the first part of the vulnerabilities in this CMS the first 19 vulnerabilities. These are Brute Force and Full path disclosure vulnerabilities in MODx. It's about 0.x and 1.x Evolution versions of MODx CMS. In 2.x...

CSRF, AoF, DoS and IAA vulnerabilities in MODx

Hello 3APA3A! I want to warn you about new security vulnerabilities in MODx. This is the second part of the vulnerabilities in this CMS 6 vulnerabilities to previous 19 vulnerabilities. These are Cross-Site Request Forgery, Abuse of Functionality, Denial of Service and Insufficient Anti-automatio...

MODx 1.0.6 XSS / Abuse Functionality / Denial Of Service

Hello list! I want to warn you about new security vulnerabilities in MODx. This is the second part of the vulnerabilities in this CMS 6 vulnerabilities to previous 19 vulnerabilities. These are Cross-Site Request Forgery, Abuse of Functionality, Denial of Service and Insufficient Anti-automation...

MODX Evolution 1.0.6 (and prior) Unauthorized Manager Access

Product: MODX Evolution Risk: Very High Severity: Critical Versions: 1.0.6 and all previous releases Vulnerabilty Type: Permissions, Privileges, and Access Control; Input Validation; SQL Injection Report Date: 2012-Nov-26 Fixed Date: 2012-Nov-26 Description The Forgot Manager Login plugin...

MODX CMS 1.x - 2.x Brute Force and Path Disclosure Vulnerabilities - Active Check

MODX CMS is prone to brute force and path disclosure vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Directory traversal

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...