CVE-2013-3514: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 plugin-preferences.php or 2 plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: thi...

CVE-2013-7376: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to 1 plugin-preferences.php...

PT-2014-2686

Name of the Vulnerable Software and Affected Versions OpenX versions prior to 2.8.10 revision 82710 Description The issue allows remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 "plugin-preferences.php" or 2 "plugin-settings.php" in www/admin. This can be...

PT-2014-3405

Name of the Vulnerable Software and Affected Versions OpenX versions 2.8.10 and possibly prior to revision 82710 Description The issue allows remote attackers to hijack the authentication of administrators. This can be achieved through requests that conduct directory traversal attacks via the gro...