CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000129
https://notcve.org/view.php?id=CVE-2017-1000129
Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure Serendipity 2.0.3 es vulnerable a una inyección de SQL en el componente blog, lo que resulta en una divulgación de información. • https://blog.s9y.org/archives/269-Serendipity-2.0.4-and-2.1-beta2-released.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-8102
https://notcve.org/view.php?id=CVE-2017-8102
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin. XSS almacenado en Serendipity v2.1-rc1 permite a un atacante robar una cookie de un administrador y otra información componiendo una nueva entrada como un usuario editor. Esto está relacionado con la falta del plugin serendipity_event_xsstrust plugin y un error set_config en ese plugin. • http://seclists.org/fulldisclosure/2017/Apr/44 https://github.com/s9y/Serendipity/issues/456 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8101
https://notcve.org/view.php?id=CVE-2017-8101
There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. Hay CSRF en Serendipity 2.0.5, permitiendo a atacantes instalar cualquier tema a través de una solicitud GET. • http://seclists.org/fulldisclosure/2017/Apr/52 https://github.com/s9y/Serendipity/issues/452 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5609
https://notcve.org/view.php?id=CVE-2017-5609
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter. Vulnerabilidad de inyección SQL en include/functions_entries.inc.php en Serendipity 2.0.5 permite a usuarios autenticados remotos ejecutar comandos arbitrarios SQL a través del parámetro cat. • http://www.securityfocus.com/bid/95850 https://github.com/s9y/Serendipity/commit/c62d667287f2d76c81e03a740a581eb3c51249b6 https://github.com/s9y/Serendipity/releases/tag/2.1-rc1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5476
https://notcve.org/view.php?id=CVE-2017-5476
Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. Serendipity hasta la versión 2.0.5 permite CSRF para la instalación de un plugin de evento o un plugin de barra lateral. • http://www.securityfocus.com/bid/95659 https://github.com/s9y/Serendipity/issues/439 • CWE-352: Cross-Site Request Forgery (CSRF) •