CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2009-4830
https://notcve.org/view.php?id=CVE-2009-4830
Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files. Vulnerabilidad no especificada en OpenX 2.8.1 y 2.8.2 permite a atacantes remotos evitar la autenticación y obtener acceso a una cuenta de Administrador mediante vectores desconocidos, posiblemente relacionados con www/admin/install.php, www/admin/install-plugins.php y otros ficheros www/admin/ . • http://blog.openx.org/12/security-matters-2 http://forum.openx.org/index.php?showtopic=503454011 http://osvdb.org/61300 http://secunia.com/advisories/37914 http://www.securityfocus.com/bid/37457 • CWE-287: Improper Authentication •
CVSS: 6.0EPSS: 12%CPEs: 5EXPL: 1CVE-2009-4098 – OpenX - 'banner-edit.php' Arbitrary File Upload / PHP Code Execution
https://notcve.org/view.php?id=CVE-2009-4098
Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory. Vulnerabilidad de subida de archivos sin restricción en banner-edit.php en OpenX adserver v2.8.1 y anteriores permite a usuarios autenticados remotamente con permisos de subida banner / file, ejecutar código de su elección mediante la carga de un archivo con una extensión ejecutable, luego accede a él a través de una petición directa al archivo en un directorio imagen. • https://www.exploit-db.com/exploits/16903 http://osvdb.org/60499 http://secunia.com/advisories/37475 http://www.openx.org/docs/2.8/release-notes/openx-2.8.2 http://www.securityfocus.com/archive/1/508050/100/0/threaded http://www.securityfocus.com/bid/37110 https://developer.openx.org/jira/browse/OX-5747 https://exchange.xforce.ibmcloud.com/vulnerabilities/54394 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2008-6163 – OpenX 2.6 - 'bannerid' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-6163
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter. Vulnerabilidad de inyección SQL en www/delivery/ac.php en OpenX v2.6.1 permite a atacantes remotos ejecutar comandos SQL a través del parámetro "bannerid" • https://www.exploit-db.com/exploits/6655 http://forum.openx.org/index.php?s=8d4c74dab4fd4597a7facda7c7414703&showtopic=503422735 http://secunia.com/advisories/32114 http://www.securityfocus.com/bid/31549 https://exchange.xforce.ibmcloud.com/vulnerabilities/45631 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 3CVE-2009-0291 – OpenX 2.6.3 - 'MAX_type' Local File Inclusion
https://notcve.org/view.php?id=CVE-2009-0291
Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the MAX_type parameter. Vulnerabilidad de salto de directorio en el archivo fc.php en OpenX 2.6.3, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos a través de .. (punto punto) en el parámetro MAX_type. • https://www.exploit-db.com/exploits/7883 https://www.exploit-db.com/exploits/32759 http://www.securityfocus.com/archive/1/500411/100/0/threaded http://www.securityfocus.com/bid/33458 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •