CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-3929
https://notcve.org/view.php?id=CVE-2013-3929
Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter. Vulnerabilidad de XSS en admin/editevent.php de CMS Made Simple (CMSMS) 1.11.9 permite a usuarios remotos autenticados con permisos de "Modify Events" inyectar script web o HTML arbitrario a través del parámetro handler. • http://secunia.com/advisories/53920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2013-4167
https://notcve.org/view.php?id=CVE-2013-4167
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en CMS Made Simple (CMSMS) anterior a la versión 1.11.7 permite a atacantes remotos inyectar script web o HTML arbitrario a través de vectores no especificados. • http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=66590&p=299356 http://www.openwall.com/lists/oss-security/2013/07/21/1 http://www.openwall.com/lists/oss-security/2013/07/25/7 https://twitter.com/LeakFree/status/336942367351394305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 86EXPL: 0CVE-2012-6064
https://notcve.org/view.php?id=CVE-2012-6064
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files. Vulnerabilidad de salto de directorio en lib/filemanager/imagemanager/images.php en CMS Made Simple (CMSMS) antes de v1.11.2.1 permite a administradores autenticados remotamente borrar archivos de su elección a través de .. (punto punto) en el parámetro deld. • http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545 http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html http://secunia.com/advisories/51185 http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple&path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php&rev=8400&peg=8498 https://exchange.xforce.ibmcloud.com/vulnerabilities/79881 https://www.htbridge.com/advisory/HTB23121 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 1%CPEs: 86EXPL: 3CVE-2012-5450 – CMS Made Simple 1.11.2 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2012-5450
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter. Una vulnerabilidad de falsificación de peticiones en sitios cruzados (CSRF) en lib/filemanager/ImageManager/images.php en CMS Made Simple (CMSMS) v1.11.2 y anteriores permite a atacantes remotos secuestrar la autenticación de los administradores de las peticiones que borran archivos de su elección a través del parámetro 'deld'. CMS Made Simple version 1.11.2 suffers from a cross site request forgery vulnerability. • http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545 http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html http://secunia.com/advisories/51185 http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple&path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php&rev=8400&peg=8498 https://exchange.xforce.ibmcloud.com/vulnerabilities/79881 https://www.htbridge.com/advisory/HTB23121 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 118EXPL: 0CVE-2012-1992 – CMS Made Simple 1.10.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2012-1992
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template). Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/edituser.php en CMS Made Simple v1.10.3 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro de correo electrónico (también conocido como el campo Dirección de correo electrónico del usuario en la plantilla de edición). CMS Made Simple versions 1.10.3 and below suffer from a cross site scripting vulnerability. • http://www.securityfocus.com/bid/52850 http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •