X2Engine 4.2 任意文件上传/ CSRF漏洞

No description provided by source...

X2Engine X2CRM Cross-Site Scripting Vulnerability

X2Engine X2CRM is the United States X2Engine company's set of open source customer relationship management program CRM. A cross-site scripting vulnerability exists in X2Engine X2CRM versions prior to 5.0.9. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...

X2Engine X2CRM Input Validation Vulnerability

X2Engine X2CRM is the United States X2Engine company's set of open source customer relationship management program CRM. An incomplete blacklist vulnerability exists in the FileUploadsFilter class in the protected/components/filters/FileUploadsFilter.php script in X2Engine X2CRM versions prior to...

X2Engine X2CRM Cross-Site Request Forgery Vulnerability

X2Engine X2CRM is the United States X2Engine company's set of open source customer relationship management program CRM. A cross-site request forgery vulnerability exists in X2Engine X2CRM versions prior to 5.2. A remote attacker can exploit this vulnerability by sending a specially crafted reques...

CVE-2015-5076

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

CVE-2015-5074

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

CVE-2015-5074

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

Input validation

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

CVE-2015-5074

CVE-2015-5074 affects X2Engine X2CRM 4.2. An incomplete blacklist in FileUploadsFilter.php allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension. This enables arbitrary file uploads and potential code execution on vulnerable installations. The i...

CVE-2015-5075

Cross-site request forgery CSRF vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create...

CVE-2015-5075

CVE-2015-5075 affects X2Engine X2CRM (affected: 4.2; fixed: 5.2). Root cause: missing CSRF protections in index.php/users/create, enabling remote attackers to create an administrator account and hijack admin authentication. Exploitation details and advisories are documented in Portcullis/Exploit-...

CVE-2015-5076

CVE-2015-5076 affects X2Engine X2CRM. The vulnerability is a reflective XSS in X2Engine/X2CRM where user-supplied data is echoed, allowing arbitrary script execution. Affected versions are listed as before 5.0.9 (per CNVD/CVE records) and, in other sources, affected 4.2 with a fix at 5.2. Exploit...

CVE-2015-5076

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

PT-2015-6769

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 5.0.9 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in different files, including version in protected/views/admin/formEditor.php, importId in...

PT-2015-6767

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 5.0.9 Description The issue is related to an incomplete blacklist vulnerability in the FileUploadsFilter class. This allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .p...

CVE-2015-5076: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...