PT-2022-19326

Name of the Vulnerable Software and Affected Versions Spip Web Framework versions v3.1.13 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the /spip.php component of Spip Web Framework. This allows attackers to execute arbitrary web scripts or HTML...

PT-2022-19328

Name of the Vulnerable Software and Affected Versions Spip Web Framework versions v3.1.13 and earlier Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the "/ecrire" endpoint via the lier trad and where parameters. Recommendations For Spip...

DSA-4798-1 spip - security update

Bulletin has no description...

SPIP parameter improper validation vulnerability

SPIP, an Internet publishing system, is free software distributed under the General Public License GPL. prive/formulaires/configurerpreferences.php in versions of SPIP prior to 3.2.8 is vulnerable to couleur, display, display navigation, displayoutils, imessage, and spipecran parameters are...

CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

DEBIAN-CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

Code injection

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

CVE-2020-28984

CVE-2020-28984 affects SPIP before 3.2.8: prive/formulaires/configurer_preferences.php fails to properly validate couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters. Public advisories (Ubuntu/Debian) map this to remote code execution or arbitrary data handli...

CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

CVE-2020-28984

prive/formulaires/configurerpreferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, displaynavigation, displayoutils, imessage, and spipecran parameters...

SPIP 安全漏洞

SPIP, an Internet publishing system, is free software distributed under the General Public License GPL. prive/formulaires/configurerpreferences.php in versions of SPIP prior to 3.2.8 is vulnerable to couleur, display, display navigation, displayoutils, imessage, and spipecran parameters are...

Ubuntu: Security Advisory (USN-4536-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4536-1: SPIP vulnerabilities

Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...

Authorization Bypas

spip is vulnerable to authorization bypass. The vulnerability exists as authenticated visitors can modify any published content and execute other modifications in the database...

Cross-site Scripting (XSS)

spip is vulnerable to cross-site scripting XSS. The vulnerability exists as it allows prive/formulaires/login.php XSS through error messages...

Open Redirects

spip is vulnerable to open redirects. The vulnerability exists as it mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

Information Disclosure

spip is vulnerable to information disclosure. The vulnerability exists as it displays different error messages from the password-reminder page depending on whether an e-mail address exists...

Cross-site Scripting (XSS)

spip is vulnerable to cross-site scripting XSS. The vulnerability exists as it is possible to inject arbitrary web script or HTML via a crafted string, through the PGP field, in ecrire/inc/textemini.php...