CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

UBUNTU-CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

Code injection

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

Code injection

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16391

SPIP vulnerability CVE-2019-16391 affects SPIP 3.1.x and 3.2.x prior to fixed releases. The issue allows authenticated visitors to modify any published content and perform other database modifications via ecrire/inc/meta.php and ecrire/inc/securiser_action.php. Affected versions: SPIP before 3.1....

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

CVE-2019-16392

SPIP vulnerability CVE-2019-16392 affects SPIP prior to 3.1.11 and 3.2 prior to 3.2.5. The issue is a cross-site scripting (XSS) through error messages exposed by login.php, allowing a remote attacker to trigger script execution via crafted input. The impact is described in CVSS terms as medium s...

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...

CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16393

CVE-2019-16393 affects SPIP web CMS: versions 3.1.x before 3.1.11 and 3.2.x before 3.2.5 mishandle redirect URLs in ecrire/inc/headers.php when encountering %0D, %0A, or %20 characters. Root cause is improper handling of redirect URLs, as described in multiple advisories. Practical impact details...

CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...

CVE-2019-16394

SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

PT-2019-4105 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to the lack of protection of the web page structure in the SPIP content management system. This can be exploited by a remote attacker to compromi...

PT-2019-4106 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to improper authorization in the SPIP content management system. It allows a remote attacker to compromise data integrity. Specifically, the...