CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 3CVE-2015-6968
https://notcve.org/view.php?id=CVE-2015-6968
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension. Múltiples vulnerabilidades de lista negra incompleta en la función serendipity_isActiveFile en include/functions_images.inc.php en Serendipity en versiones anteriores a 2.0.2, permite a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la carga de un archivo con una extensión (1) .pht o (2) .phtml. • http://blog.curesec.com/article/blog/Serendipity-201-Code-Execution-48.html http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html http://packetstormsecurity.com/files/133426/Serendipity-2.0.1-Shell-Upload.html http://seclists.org/fulldisclosure/2015/Sep/6 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2015-6969
https://notcve.org/view.php?id=CVE-2015-6969
Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link. Vulnerabilidad de XSS en js/2k11.min.js en el tema 2k11 en Serendipity en versiones anteriores a 2.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un nombre de usuario en un comentario, lo cual no es manejado adecuadamente en un enlace Reply. • http://blog.curesec.com/article/blog/Serendipity-201-Persistent-XSS-51.html http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html http://packetstormsecurity.com/files/133427/Serendipity-2.0.1-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Sep/9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 3CVE-2015-6943
https://notcve.org/view.php?id=CVE-2015-6943
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php. Vulnerabilidad de inyección SQL en la función serendipity_checkCommentToken en include/functions_comments.inc.php en Serendipity en versiones anteriores a 2.0.2, cuando "Use Tokens for Comment Moderation" está habilitado, permite a administradores remotos ejecutar comandos SQL arbitrarios a través del parámetro serendipity[id] parameter en serendipity_admin.php. • http://blog.curesec.com/article/blog/Serendipity-201-Blind-SQL-Injection-52.html http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html http://packetstormsecurity.com/files/133428/Serendipity-2.0.1-Blind-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Sep/10 http://www.securitytracker.com/id/1033558 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-2289
https://notcve.org/view.php?id=CVE-2015-2289
Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category. Vulnerabilidad de XSS en templates/2k11/admin/entries.tpl en Serendipity anterior a 2.0.1 permite a editores remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro serendipity[cat][name] en serendipity_admin.php, cuando crea una categoría nueva. • http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.html http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html http://www.openwall.com/lists/oss-security/2015/03/14/1 http://www.securityfocus.com/archive/1/534871/100/0/threaded http://www.securitytracker.com/id/1031961 https://github.com/s9y/Serendipity/commit/a30886d3bb9d8eeb6698948864c77caaa982435d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2014-9432
https://notcve.org/view.php?id=CVE-2014-9432
Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php. Múltiples vulnerabilidades de XSS en templates/2k11/admin/overview.inc.tpl en Serendipity anterior a 2.0-rc2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un comentario en un blog en QUERY_STRING en serendipity/index.php. • http://blog.s9y.org/archives/259-Serendipity-2.0-rc2-released.html http://packetstormsecurity.com/files/129709/CMS-Serendipity-2.0-rc1-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2014/Dec/108 http://sroesemann.blogspot.de/2014/12/bericht-zu-sroeadv-2014-02.html http://www.securityfocus.com/archive/1/534315/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/99464 https://github.com/s9y/Serendipity/commit/36cde3030aaa27a46bf94086e062dfe56b60230b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •