CVE-2018-12043

content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page...

CVE-2018-12043

Symphony CMS 2.7.6 is affected by a cross-site scripting (XSS) vulnerability in content/content.blueprintspages.php, via the pages content page. The root cause is lack of sanitization of the page parameter, enabling insertion of arbitrary web script/HTML. The CVE descriptions consistently identif...

b3log Symphony Arbitrary File Upload Vulnerability

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A security vulnerability exists in b3log Symphony version 2.6.0. A remote attacker can exploit this vulnerability by sending the 'name' parameter to the...

Design/Logic Flaw

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

CVE-2018-10469

CVE-2018-10469 affects b3log Symphony (Sym) 2.6.0. A remote attacker can upload and execute arbitrary JSP files by sending the name[] parameter to the /upload URI, enabling remote code execution with partial to high impact as per the CVE description. No explicit remediation/patch details are prov...

b3log Symphony cross-site scripting vulnerability (CNVD-2017-38345)

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability to obtain a user cookie by...

CVE-2017-16956

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

Cross site scripting

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

CVE-2017-16956

b3log Symphony aka Sym 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title...

CVE-2017-16956

Affected product: b3log Symphony (Sym) 2.2.0. Vulnerability: Cross-site scripting in the private messaging flow, exploited by sending a private letter with a specific /article URI followed by a second private letter with a modified title to obtain a user cookie. Root cause / impact: XSS issue ena...

b3log Symphony Cross-Site Scripting Vulnerability

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability by sending a specially craft...

Directory Traversal

Symphony is vulnerable to directory traversal attacks. The read function in the bundle readers does not sanitize user input, allowing a malicious user to traverse the directory...

b3log Symphony cross-site scripting vulnerability (CNVD-2017-37885)

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in the processor/AdminProcessor.java file in the admin console of b3log Symphony version 2.2.0. A remote...

CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

CVE-2017-16881

The CVE-2017-16881 entry describes a Cross-Site Scripting (XSS) vulnerability in b3log Symphony (Sym) 2.2.0. A crafted userAvatarURL value sent to /settings/avatar can inject arbitrary scripts/HTML due to improper handling of JSON objects. The issue affects multiple components, including processo...

CVE-2017-16881

b3log Symphony aka Sym 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java,...

CVE-2017-16821

b3log Symphony aka Sym 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid...