CVE-2008-7213

Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...

CVE-2008-7215

The CVE-2008-7215 entry concerns MOStlyCE (MOStlyContent Editor) as used in Mambo 4.6.3 and earlier. The Image Manager of MOStlyCE before version 2.4 allows remote attackers to rename arbitrary files and trigger a denial of service by sending modified file[NewFile][name], file[NewFile][tmp_name],...

CVE-2008-7215: Improper Input Validation

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

CVE-2008-7214: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2008-7212: Undefined Security Weakness

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...

CVE-2008-7213: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...

CVE-2008-2500

Cross-site scripting XSS vulnerability in the MOStlyContent Editor MOStlyCE component before 3.0 for Mambo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-2500

MOStlyContent Editor (MOStlyCE) for Mambo, prior to version 3.0, is affected by a Cross-site Scripting (XSS) vulnerability. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The documents do not specify affected build numbers beyond “before 3.0,” no...

Mambo MOStlyCE Mambot Arbitrary File Rename

The remote host is running MOStlyContent Editor MOStlyCE, the default WYSIWYG editor for Mambo. The version of MOStlyCE installed on the remote host contains a design flaw that may allow an attacker to rename files subject to the privileges of the web server user id. An unauthenticated attacker m...

Mambo Module MOStlyCE 2.4 Image Manager Utility - Arbitrary File Upload

source: https://www.securityfocus.com/bid/27472/info The MOStlyCE module for Mambo is prone to an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to upload and execute arbitrary script co...

Mambo Module MOStlyCE 2.4 - connector.php Cross-Site Scripting

Mambo Module MOStlyCE 2.4 - connector.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27470/info The MOStlyCE module for Mambo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this...

Mambo Module MOStlyCE 2.4 - 'connector.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27470/info The MOStlyCE module for Mambo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Mambo Module MOStlyCE 2.4 Image Manager Utility - Arbitrary File Upload

Mambo Module MOStlyCE 2.4 Image Manager Utility - Arbitrary File Upload source: https://www.securityfocus.com/bid/27472/info The MOStlyCE module for Mambo is prone to an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this...

CVE-2006-7104

PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor MOStlyCE as created on May 2006, a component for Mambo 4.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

CVE-2006-7104

The CVE-2006-7104 entry describes a PHP remote file inclusion vulnerability in MOStlyContent Editor (MOStlyCE) for Mambo 4.5.4. The flaw is in htmltemplate.php where remote code execution is possible via a URL supplied to the mosConfig_absolute_path parameter, enabling an attacker to run arbitrar...

Mambo Module MOStlyCE 4.5.4 - 'HTMLTemplate.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/20549/info Mambo MostlyCE is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks ar...

Mambo Module MOStlyCE 4.5.4 - HTMLTemplate.php Remote File Inclusion

Mambo Module MOStlyCE 4.5.4 - HTMLTemplate.php Remote File Inclusion source: https://www.securityfocus.com/bid/20549/info Mambo MostlyCE is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to...