CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 2CVE-2013-4889 – Xibo - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2013-4889
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888. Múltiples vulnerabilidades de CSRF en index.php de Digital Signage Xibo 1.4.2 permite a atacantes remotos secuestrar la autenticación de administradores por peticiones que (1) añadan un nuevo administrador a través de una acción AddUser o (2) lleven a cabo ataques de XSS, tal y como se demuestra en CVE-2013-4888. • https://www.exploit-db.com/exploits/38746 http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2013-4888 – Xibo - 'layout' HTML Injection
https://notcve.org/view.php?id=CVE-2013-4888
Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page. Vulnerabilidad de XSS en index.php de Digital Signage Xibo 1.4.2 permite a atacantes remotos inyectar script Web o HTML arbitrario a través del parámetro layout en la página de disposición. • https://www.exploit-db.com/exploits/38745 http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-4887
https://notcve.org/view.php?id=CVE-2013-4887
SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter. Vulnerabilidad de inyección de SQL en index.php en Digital Signage Xibo 1.4.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro displayid. • http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html http://www.securityfocus.com/bid/62071 https://exchange.xforce.ibmcloud.com/vulnerabilities/86777 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 4%CPEs: 8EXPL: 2CVE-2013-5979 – Xibo 1.2.2/1.4.1 - 'index.php?p' Directory Traversal
https://notcve.org/view.php?id=CVE-2013-5979
Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php. Vulnerabilidad de salto de directorio en Spring Signage Xibo v1.2.x anterior a v1.2.3 y v1.4.x anterior a v1.4.2 permite a atacantes remotos leer ficheros arbitrarios a través de un (punto punto) en el parámetro al index.php. • https://www.exploit-db.com/exploits/26955 http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-%28DS-2013-00 https://bugs.launchpad.net/xibo/+bug/1093967 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •