Serendipity跨站脚本漏洞和SQL注入漏洞

BUGTRAQ ID: 65449 Serendipity是Serendipity团队开发的一套基于PHP的博客系统。该系统支持创建在线日记、博客、网页等。 Serendipity中存在跨站脚本漏洞和SQL注入漏洞。攻击者可利用这些漏洞窃取基于cookie的身份认证，控制应用程序，访问或修改数据，或利用底层数据库中潜在的漏洞。Serendipity 1.7.5版本中存在漏洞，其他版本也可能受到影响。 0 Serendipity 1.7.5 厂商补丁： Serendipity ----- 目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.s9y.org/...

Serendipity 1.7.5 (Backend) - Multiple Vulnerabilities

Exploit for php platform in category web applications The Serendipity 1.7.5 backend is prone to multiple security vulnerabilities ========================== PoC-Exploit ========================== // Stored-XSS with "Real name" 1 Login as "Standard editor" user 2 Under "Personal Settings" set your...

Serendipity 1.7.5多个漏洞

Serendipity是Serendipity团队开发的一套基于PHP的博客系统。该系统支持创建在线日记、博客、网页等。 Serendipity存在多个输入验证漏洞，攻击者可以利用漏洞获得用户敏感信息或服务器主机控制权限。 0 Serendipity 1.7.5 厂商补丁： Serendipity ----- Serendipity 1.7.7版本以修复此漏洞，建议用户下载使用： http://www.s9y.org/ // Stored-XSS with "Real name" 1 Login as "Standard editor" user 2 Under "Personal...

S9Y Serendipity 1.7.5 - Backend Multiple Vulnerabilities

S9Y Serendipity 1.7.5 - Backend Multiple Vulnerabilities Advisory: Serendipity 1.7.5 Backend - Multiple security vulnerabilities Advisory ID: SSCHADV2014-003 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.7.5 Vendor URL: http://www.s9y.org/ Vendor Status: fixed...

S9Y Serendipity 1.7.5 - 'Backend' Multiple Vulnerabilities

Advisory: Serendipity 1.7.5 Backend - Multiple security vulnerabilities Advisory ID: SSCHADV2014-003 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.7.5 Vendor URL: http://www.s9y.org/ Vendor Status: fixed ========================== Vulnerability Description...

CVE-2013-5670

Cross-site scripting XSS vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the torlist parameter...

CVE-2013-5670

Cross-site scripting XSS vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the torlist parameter...

CVE-2013-5670

Cross-site scripting XSS vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the torlist parameter...

CVE-2013-5670

CVE-2013-5670 is a cross-site scripting (XSS) vulnerability in the htmlarea SpellChecker module’s spell-check-savedicts.php, affecting Serendipity prior to 1.7.3. The issue allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter. The vulnerability is due to impr...

CVE-2013-5314

Cross-site scripting XSS vulnerability in serendipityadminimageselector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipityhtmltarget parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in serendipityadminimageselector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipityhtmltarget parameter...

CVE-2013-5314

Cross-site scripting XSS vulnerability in serendipityadminimageselector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipityhtmltarget parameter...

CVE-2013-5314

CVE-2013-5314 is an XSS vulnerability in Serendipity up to version 1.6.2, triggered in serendipity_admin_image_selector.php via the serendipity[htmltarget] parameter. The issue allows remote attackers to inject arbitrary scripts/HTML. Affected software is Serendipity 1.6.2 and earlier (no product...

CVE-2013-5314

Cross-site scripting XSS vulnerability in serendipityadminimageselector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipityhtmltarget parameter...

S9Y Serendipity 1.6.2 - 'serendipity_admin_image_selector.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/61138/info Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

S9Y Serendipity 1.6.2 - serendipity_admin_image_selector.php Cross-Site Scripting

S9Y Serendipity 1.6.2 - serendipityadminimageselector.php Cross-Site Scripting source: https://www.securityfocus.com/bid/61138/info Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to...

Serendipity 1.6.2 Cross Site Scripting

Information -------------------- Name : XSS Vulnerabilities in Serendipity Software : Serendipity 1.6.2 and possibly below. Vendor Homepage : http://www.s9y.org/ Vulnerability Type : Cross-Site Scripting Severity : Medium Researcher : Omar Kurt Advisory Reference : NS-13-003 Description...

SERENDIPITY-1.7-RC2 Multiple Xss Vulnerability

Serendipity is a PHP-powered weblog application which gives the user an easy way to maintain an online diary, weblog or even a complete homepage. While the default package is designed for the casual blogger, Serendipity offers a flexible, expandable and easy-to-use framework with the power for...

Serendipity 1.6.1 SQL Injection

SQL Injection vulnerability in Serendipity Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

CVE-2012-2332

SQL injection vulnerability in serendipity/serendipityadmin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipityplugintoconf parameter. NOTE: this issue might be resultant from cross-site request forgery CSRF...