8 results (0.005 seconds)

CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0

CVE-2020-10964

https://notcve.org/view.php?id=CVE-2020-10964

Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename. Serendipity versiones anteriores a 2.3.4 en Windows, permite a atacantes remotos ejecutar código arbitrario porque el nombre de archivo de un archivo renombrado puede terminar con un punto. Este archivo luego puede ser renombrado para tener un nombre de archivo .php. • https://blog.s9y.org/archives/290-Serendipity-2.3.4-released-security-update.html https://github.com/s9y/Serendipity/releases/tag/2.3.4 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-11870

https://notcve.org/view.php?id=CVE-2019-11870

Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature. Serendipity, versiones anteriores a 2.1.5, es vulnerable a un ataque XSS a través de datos EXIF que son gestionados de manera incorrecta en las plantillas/2k11/admin/media_choose.tpl o en las plantillas/2k11/admin/media_items.tpl de la funcionalidad Media Library. • http://www.openwall.com/lists/oss-security/2019/05/10/1 https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html https://github.com/s9y/Serendipity/issues/598 https://www.openwall.com/lists/oss-security/2019/05/03/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-8101

https://notcve.org/view.php?id=CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. Hay CSRF en Serendipity 2.0.5, permitiendo a atacantes instalar cualquier tema a través de una solicitud GET. • http://seclists.org/fulldisclosure/2017/Apr/52 https://github.com/s9y/Serendipity/issues/452 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-5609

https://notcve.org/view.php?id=CVE-2017-5609

SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter. Vulnerabilidad de inyección SQL en include/functions_entries.inc.php en Serendipity 2.0.5 permite a usuarios autenticados remotos ejecutar comandos arbitrarios SQL a través del parámetro cat. • http://www.securityfocus.com/bid/95850 https://github.com/s9y/Serendipity/commit/c62d667287f2d76c81e03a740a581eb3c51249b6 https://github.com/s9y/Serendipity/releases/tag/2.1-rc1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-5476

https://notcve.org/view.php?id=CVE-2017-5476

Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. Serendipity hasta la versión 2.0.5 permite CSRF para la instalación de un plugin de evento o un plugin de barra lateral. • http://www.securityfocus.com/bid/95659 https://github.com/s9y/Serendipity/issues/439 • CWE-352: Cross-Site Request Forgery (CSRF) •