Piwik < 0.6 form_url参数跨站脚本漏洞

BugCVE: CVE-2010-1453 BUGTRAQ: 39144 Piwik是一款利用Php+MySQL技术构建的开源网页访问统计系统。 Piwik没有正确地过滤提交给index.php页面的formurl参数便返回给了用户，攻击者诱骗用户跟随恶意的登录URL链接就可以执行反射式跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 Piwik 0.6 厂商补丁： Piwik ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://piwik.org/latest.zip...

FreeBSD : piwik -- XSS vulnerability (c0869649-5a0c-11df-942d-0015587e2cc1)

The Piwik security advisory reports : A non-persistent, cross-site scripting vulnerability XSS was found in Piwik's Login form that reflected the formurl parameter without being properly escaped or filtered. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

CVE-2010-1453

Cross-site scripting XSS vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter...

CVE-2010-1453

Cross-site scripting XSS vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter...

CVE-2010-1453

The CVE-2010-1453 issue affects Piwik up to v0.5.5, where the Login form did not properly filter the form_url parameter, enabling reflected XSS. Affected versions include 0.1.6 through 0.5.5; exploitation allows remote injection of arbitrary script/HTML via form_url. Several connected sources (Re...

CVE-2010-1453

Cross-site scripting XSS vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter...

piwik -- cross site scripting vulnerability

The Piwik security advisory reports: A non-persistent, cross-site scripting vulnerability XSS was found in Piwik's Login form that reflected the formurl parameter without being properly escaped or filtered...

Piwik 0.5.5 Cross Site Scripting

Title: Piwik 0.5.5 Cross-Site Scripting Vulnerability Date: 3/29/2010 Author: garwga Software Link: http://piwik.org/ Version: 0.5.5 ================================================================= Piwik 0.5.5 Cross-Site Scripting Vulnerability...

Piwik 0.5.5 - form_url Cross-Site Scripting

Piwik 0.5.5 - formurl Cross-Site Scripting source: https://www.securityfocus.com/bid/39144/info Piwik is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser ...

Piwik 0.5.5 - 'form_url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/39144/info Piwik is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

Piwik 0.2.35 - 0.4.3 PHP Code Execution Vulnerability

Piwik is prone to PHP Code Execution vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwik:piwik"; ifdescription...

Piwik ofc_upload_image.php远程PHP代码执行漏洞

BUGTRAQ ID: 37314 CVECAN ID: CVE-2009-4140 Piwik是一款利用Php+MySQL技术构建的开源网页访问统计系统。 Piwik中使用了open-flash-chart模块执行制表操作，该模块没有正确的过滤提交给ofcuploadimage.php文件的name和HTTPRAWPOSTDATA参数便用于创建文件： ? $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination =...

CVE-2009-4137

The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the...

Immunity Canvas: PIWIK

Name| piwik ---|--- CVE| CVE-2009-4137 Exploit Pack| CANVAS Description| Piwik unserialize + destruct Notes| References: 'http://www.sektioneins.com/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/', 'http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4137' Notes: This...

Code injection

The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the...

CVE-2009-4137

The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the...

CVE-2009-4137

Summary (CVE-2009-4137) : The vulnerability in Piwik ≤ 0.4x/0.5 involves loadContentFromCookie() feeding data from cookies into unserialize(), enabling remote code execution or arbitrary file upload via multiple vectors that touch __destruct in Piwik_Config, php://filter URIs, Zend Framework comp...

CVE-2009-4137

The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the...

CVE-2009-4140

Unrestricted file upload vulnerability in ofcuploadimage.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when registerglobals is enabled, allows remote authenticated users to...