33 matches found
EUVD-2008-7172
Malware in sbrugna...
EUVD-2008-7174
Malware in sbrugna...
EUVD-2008-7173
Malware in sbrugna...
Mambo Open Source 4.6.2 mambots/editors/mostlyce/ .. /php/connector.php Query String XSS
No description provided by source. source: http://www.securityfocus.com/bid/30708/info Mambo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser o...
Mambo MostlyCE 4.5.4 HTMLTemplate.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20549/info Mambo MostlyCE is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the application and the...
Mambo MOStlyCE Module 2.4 Image Manager Utility Arbitrary File Upload Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27472/info The MOStlyCE module for Mambo is prone to an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to uplo...
Mambo MOStlyCE 2.4 Module - 'connector.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27470/info The MOStlyCE module for Mambo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...
CVE-2008-7214
Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...
Command injection
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...
Cross site scripting
Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...
CVE-2008-7215
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...
CVE-2008-7213
Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...
CVE-2008-7212
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...
Design/Logic Flaw
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...
CVE-2008-7215
The CVE-2008-7215 entry concerns MOStlyCE (MOStlyContent Editor) as used in Mambo 4.6.3 and earlier. The Image Manager of MOStlyCE before version 2.4 allows remote attackers to rename arbitrary files and trigger a denial of service by sending modified file[NewFile][name], file[NewFile][tmp_name],...
CVE-2008-7212
The CVE-2008-7212 vulnerability affects MOStlyCE before 2.4 used with Mambo 4.6.3 and earlier. It allows remote attackers to trigger error messages via requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, revealing the installation path. No exploitation...
CVE-2008-7214
Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...
CVE-2008-7214
The CVE-2008-7214 entry describes a CSRF flaw in MOStlyCE before 2.4 (used in Mambo 4.6.3 and earlier) affecting administrator/index2.php. The vulnerability lets remote attackers hijack an administrator’s session to add new administrator accounts via the save task in a com_users action, with the ...
CVE-2008-7213
CVE-2008-7213 describes an XSS vulnerability in MOStlyCE (used with Mambo 4.6.3 and earlier) via the Command parameter in the PHP connector for TinyMCE filemanager (path: mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php). The issue arises in MOStlyCE before vers...