1868 matches found
CVE-2014-6048
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request...
CVE-2014-6050
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...
CVE-2014-6049
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...
CVE-2014-6047
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks...
Server side request forgery (ssrf)
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request...
Design/Logic Flaw
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks...
Cross site request forgery (csrf)
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...
Sql injection
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function...
CVE-2014-6046
Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...
Authorization
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...
CVE-2014-6045
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...
CVE-2014-6046
CVE-2014-6046 affects phpMyFAQ prior to 2.8.13. The root cause is lack of CSRF token validation, enabling CSRF to perform actions such as deleting active users, deleting/opening questions, activating users, publishing FAQs, managing Glossary/FAQ news, and adding/deleting comments or votes. The im...
CVE-2014-6046
Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...
CVE-2014-6049
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...
CVE-2014-6047
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks...
CVE-2014-6048
The CVE-2014-6048 flaw affects phpMyFAQ before version 2.8.13, where an attacker can read arbitrary attachments via a direct request due to a missing check on whether an attachment is being requested. Public references describe unauthenticated read access and verify the core issue as improper acc...
CVE-2014-6047
CVE-2014-6047 affects phpMyFAQ prior to 2.8.13. The vulnerability exists in the download attachments path (phpmyfaq/attachment.php) due to incorrect permission checks, enabling remote authenticated users with some rights (e.g., add/delete attachments) to read arbitrary attachments they should not...
CVE-2014-6050
CVE-2014-6050 affects phpMyFAQ prior to 2.8.13 and allows remote attackers to bypass CAPTCHA protection by replaying the request. NVD describes CAPTCHA bypass; Veracode notes bypass of form protections via replay. Documented impact is bypass of CAPTCHA on forms; no remediation details are provide...