UBUNTU-CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16391

SPIP vulnerability CVE-2019-16391 affects SPIP 3.1.x and 3.2.x prior to fixed releases. The issue allows authenticated visitors to modify any published content and perform other database modifications via ecrire/inc/meta.php and ecrire/inc/securiser_action.php. Affected versions: SPIP before 3.1....

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16392

SPIP vulnerability CVE-2019-16392 affects SPIP prior to 3.1.11 and 3.2 prior to 3.2.5. The issue is a cross-site scripting (XSS) through error messages exposed by login.php, allowing a remote attacker to trigger script execution via crafted input. The impact is described in CVSS terms as medium s...

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

CVE-2019-16393

CVE-2019-16393 affects SPIP web CMS: versions 3.1.x before 3.1.11 and 3.2.x before 3.2.5 mishandle redirect URLs in ecrire/inc/headers.php when encountering %0D, %0A, or %20 characters. Root cause is improper handling of redirect URLs, as described in multiple advisories. Practical impact details...

CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16394

SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

PT-2019-4106 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to improper authorization in the SPIP content management system. It allows a remote attacker to compromise data integrity. Specifically, the...

PT-2019-4105 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to the lack of protection of the web page structure in the SPIP content management system. This can be exploited by a remote attacker to compromi...

SPIP 3.1.x/3.2.x Authenticated RCE Vulnerability

SPIP allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Debian DSA-4429-1 : spip - security update

It was discovered that SPIP, a website engine for publishing, did not properly sanitize its user input. This would allow an authenticated user to perform arbitrary command execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian: Security Advisory (DSA-4429-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SPIP Arbitrary Code Execution Vulnerability

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in SPIP version 3.1 prior to 3.1.10 and version 3.2 prior to 3.2.4, which is caused by the program incorrectly handling varmemotri. An attacker can exploit this...