CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9070
https://notcve.org/view.php?id=CVE-2017-9070
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php. En MODX Revolution, en versiones anteriores a la 2.5.7, un usuario con permisos para editar recursos puede inyectar una carga útil XSS en el título de cualquier publicación mediante el parámetro pagetitle en connectors/index.php. • https://citadelo.com/en/2017/04/modx-revolution-cms https://github.com/modxcms/revolution/pull/13415 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9071
https://notcve.org/view.php?id=CVE-2017-9071
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning. En MODX Revolution anterior a versión 2.5.7, un atacante podría ser capaz de desencadenar un problema de XSS mediante la inyección de una carga útil en el encabezado Host HTTP de una petición. Esto es explotable solo en conjunto con otros problemas como el envenenamiento de la caché. • https://citadelo.com/en/2017/04/modx-revolution-cms https://github.com/modxcms/revolution/pull/13426 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7322
https://notcve.org/view.php?id=CVE-2017-7322
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate. Las funcionalidades (1) update y (2) package-installation features en MODX Revolution 2.5.4-pl y versiones anteriores no verifican certificados X.509 de servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y activar la ejecución de código arbitrario a través de un certificado manipulado. • http://www.securityfocus.com/bid/97228 https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2017-7321
https://notcve.org/view.php?id=CVE-2017-7321
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI. setup/controllers/welcome.php en MODX Revolution 2.5.4-pl y versiones anteriores permite a atacantes remotos ejecutar código PHP arbitrario a través del parámetro config_key para la URI setup/index.php?action=welcome. • http://www.securityfocus.com/bid/97228 https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7320
https://notcve.org/view.php?id=CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value. setup/controllers/language.php en MODX Revolution 2.5.4-pl y versiones anteriores no restringe adecuadamente el parámetro language, lo que permite a atacantes remotos llevar a cabo ataques de bombardeo de cookies y provocar una denegación de servicio (agotamiento de la cuota de cookie), o llevar a cabo ataques HTTP Response Splitting con XSS resultante, a través de un valor de parámetro no válido. • http://www.securityfocus.com/bid/97228 https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •