CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12657
https://notcve.org/view.php?id=CVE-2018-12657
22 Jun 2018 — Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI. Existe Cross-Site Scripting (XSS) reflejado en el módulo Master File en SLiMS 8 Akasia 8.3.1 mediante un URI admin/modules/master_file/rda_cmc.php?keywords=. • https://github.com/slims/slims8_akasia/issues/101 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12655
https://notcve.org/view.php?id=CVE-2018-12655
22 Jun 2018 — Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a related issue to CVE-2017-7242. Existe Cross-Site Scripting (XSS) reflejado en el módulo Circulation en SLiMS 8 Akasia 8.3.1 mediante un URI admin/modules/circulation/loan_rules.php?keywords=. Este problema está relacionado con CVE-2017-7242. • https://github.com/slims/slims8_akasia/issues/99 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12659
https://notcve.org/view.php?id=CVE-2018-12659
22 Jun 2018 — SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter. SLiMS 8 Akasia 8.3.1 permite que atacantes remotos omitan el mecanismo de protección CSRF y obtengan acceso eludiendo el parámetro csrf_token. • https://github.com/slims/slims8_akasia/issues/103 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12656
https://notcve.org/view.php?id=CVE-2018-12656
22 Jun 2018 — Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI. Existe Cross-Site Scripting (XSS) reflejado en el módulo Membership en SLiMS 8 Akasia 8.3.1 mediante un URI admin/modules/membership/index.php?keywords=. • https://github.com/slims/slims8_akasia/issues/100 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12654
https://notcve.org/view.php?id=CVE-2018-12654
22 Jun 2018 — Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI. Existe Cross-Site Scripting (XSS) reflejado en el módulo Bibliography en SLiMS 8 Akasia 8.3.1 mediante un URI admin/modules/bibliography/index.php?keywords=. • https://github.com/slims/slims8_akasia/issues/98 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2017-12585
https://notcve.org/view.php?id=CVE-2017-12585
06 Aug 2017 — SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users. SLiMS 8 Akasia en su versión 8.3.1 tiene una inyección SQL en admin/AJAX_lookup_handler.php (parámetros tableName y tableFields), admin/AJAX_check_id.php y admin/AJAX_vocabolary_control.php. Esta vulnerabilidad puede ser explotada por usuarios remotos de librería aut... • https://github.com/slims/slims8_akasia/issues/47 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2017-12586
https://notcve.org/view.php?id=CVE-2017-12586
06 Aug 2017 — SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users. La versión 8.3.1 de SLiMS 8 Akasia tiene un problema de lectura de archivos arbitrarios debido a un salto de directorio en el parámetro url al admin/help.php. Esta vulnerabilidad puede ser explotada por usuarios remotos de librería remotos autenticados. • https://github.com/slims/slims8_akasia/issues/48 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •