Page 2 of 22 results (0.007 seconds)

CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0

CVE-2017-10673

https://notcve.org/view.php?id=CVE-2017-10673

29 Jun 2017 — admin/profile.php in GetSimple CMS 3.x has XSS in a name field. admin/profile.php en GetSimple CMS 3.x tiene Cross-Site Scripting (XSS) en un campo name. • https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1234 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-8081

https://notcve.org/view.php?id=CVE-2017-8081

30 Apr 2017 — Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce. Una mala inicialización criptográfica del salt en admin/inc/template_functions.php en GetSimple CMS versión 3.3.13 permite a un atacante de red escalar privilegios a un usuario arbitrario o producir ataques CSRF mediante el cálculo de una cookie de sesión o un CSRF de... • https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2014-8723

https://notcve.org/view.php?id=CVE-2014-8723

17 Mar 2017 — GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php, which reveals the installation path in an error message. GetSimple CMS 3.3.4 permite a atacantes remotos obtener información sensible a través de una solicitud directa a (1) plugins/anonymous_data.php o (2) plugins/InnovationPlugin.php, lo que revela la ruta de instalación en un mensaje de error. • http://rossmarks.uk/portfolio.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 3

CVE-2014-8722 – GetSimple CMS 3.3.4 - Information Disclosure

https://notcve.org/view.php?id=CVE-2014-8722

17 Mar 2017 — GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/.xml, (2) backups/users/.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml. GetSimple CMS 3.3.4 permite a atacantes remotos obtener información sensible mediante una solicitud directa a (1) data/users/.xml, (2) backups/users/.xml.bak, (3) data/other/authorization.xml, o (4) data/other/appid.xml. GetSimple CMS version 3.3.4 suffers from an information dis... • https://packetstorm.news/files/id/162906 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2

CVE-2015-5355

https://notcve.org/view.php?id=CVE-2015-5355

01 Jul 2015 — Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php. Múltiples vulnerabilidades de XSS en GetSimple CMS anterior a 3.3.6 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro (1) post-content o (2) post-title en admin/edit.php. • http://packetstormsecurity.com/files/132481/GetSimple-CMS-5.7.3.1-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-5356

https://notcve.org/view.php?id=CVE-2015-5356

01 Jul 2015 — Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter. Vulnerabilidad de XSS en admin/filebrowser.php en GetSimple CMS anterior a 3.3.6 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro func. • https://github.com/GetSimpleCMS/GetSimpleCMS/commit/cb1845743bd11ba74a49b6b522c080df86a17d51 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 4

CVE-2014-8790 – GetSimple CMS 3.3.4 XML External Entity Injection

https://notcve.org/view.php?id=CVE-2014-8790

31 Dec 2014 — XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter. Vulnerabilidad de entidad externa XML (XXE) en admin/api.php en GetSimple CMS 3.1.1 hasta 3.3.x anterior a 3.3.5 Beta 1, cuando está en ciertas configuraciones, permite a atacantes remotos leer ficheros arbitrarios a través del parámetro data. GetSimple CMS versions 3.1.1 through 3.3.4 suffer... • https://packetstorm.news/files/id/129778 •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 4

CVE-2014-1603 – GetSimple CMS 3.3.1 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-1603

13 May 2014 — Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php. Múltiples vulnerabilidades de XSS en GetSimple CMS 3.3.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) el parámetro param hacia admin/load.php o el parámetro (2) user, (3) email o ... • https://packetstorm.news/files/id/126598 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2

CVE-2013-7243 – GetSimple CMS 3.1.2 / 3.2.3 Cross Site Scripting

https://notcve.org/view.php?id=CVE-2013-7243

07 Jan 2014 — Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621. Múltiples vulnerabilidades cross-site scripting (XSS) en GetSimple CMS v3.1.2 y v3.2.3 permiten a atacantes remotos inyectar secuencias de comandos Web o HTML a través (1) del campo ... • https://packetstorm.news/files/id/124711 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 22EXPL: 1

CVE-2012-6621 – GetSimple CMS 3.1.2 / 3.2.3 Cross Site Scripting

https://notcve.org/view.php?id=CVE-2012-6621

07 Jan 2014 — Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php. Múltiples vulnerabilidades de XSS en GetSimple CMS 3.1, 3.1.2, 3.2.3, y anteriores ver... • https://packetstorm.news/files/id/124711 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •