NoneCms Cross-Site Request Forgery Vulnerability

NoneCms is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site request forgery vulnerability exists in application/admin/controller/Admin.php in NoneCms 1.3.0. Attackers can use this...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

Cross site request forgery (csrf)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

CVE-2018-7219

CVE-2018-7219 affects NoneCms 1.3.0. The issue is a Cross-Site Request Forgery in application/admin/controller/Admin.php that allows modifying the administrator password or adding an account via public/index.php/admin/admin/edit.html. The root cause is CSRF in the admin controller; no remediation...

CVE-2018-7219: Cross-Site Request Forgery (CSRF)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

CVE-2018-6022

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...

Directory traversal

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...

Server side request forgery (ssrf)

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6022

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6022

CVE-2018-6022 : A directory traversal vulnerability exists in NoneCms (versions through 1.3.0) in the file application/admin/controller/Main.php . The issue allows remote authenticated users with back-office access to delete arbitrary files by supplying a backslash sequence (for example, ..\) in ...

CVE-2018-6029

CVE-2018-6029 affects NoneCms 1.3.0. The vulnerability exists in the copy function of application/admin/controller/Article.php, where SSRF is possible because URL validation only checks for the substring "csdn". This allows remote attackers to access internal and external network resources. No ex...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

CVE-2018-6022

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...

NoneCms Server-Side Request Forgery Vulnerability

NoneCms is an open source CMS Content Management System for quickly building corporate websites, personal blogs and supporting mobile. A cross-site request forgery vulnerability exists in the 'copy' function of the application/admin/controller/Article.php file in NoneCms version 1.3.0, which stem...

NoneCms Directory Traversal Vulnerability

NoneCms is an open source CMS Content Management System for quickly building corporate websites, personal blogs and supporting mobile. A directory traversal vulnerability exists in the application/admin/controller/Main.php file in NoneCms 1.3.0 and earlier versions. A remote attacker can exploit...

CVE-2018-6022: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...