Page 4 of 38 results (0.004 seconds)

CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0

CVE-2009-4083

https://notcve.org/view.php?id=CVE-2009-4083

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) submitnews.php, (2) usersettings.php; and (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, and (11) mailout.php in e107_admin/. NOTE: this may overlap CVE-2004-2040 and CVE-2006-4794, but there are insufficient details to be certain. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados(XSS) en e107 v0.7.16 y anteriores permite a atacantes remotos permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados en (1) submitnews.php, (2) usersettings.php; y (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, y(11) mailout.php en e107_admin/. NOTA: esta vulnerabilidad puede solaparse con CVE-2004-2040 y CVE-2006-4794, pero no hay suficientes detalles para tener certeza. • http://blog.bkis.com/e107-multiple-vulnerabilities http://www.securityfocus.com/archive/1/508007/100/0/threaded http://www.securityfocus.com/bid/37087 https://exchange.xforce.ibmcloud.com/vulnerabilities/54372 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 2

CVE-2009-3444 – e107 0.7.16 - Referer header Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2009-3444

Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en email.php en e107 v0.7.16 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de la cabecera HTTP Referer en una acción news.1 (también conocida como noticias (news) a correo (email). • https://www.exploit-db.com/exploits/9825 http://osvdb.org/58363 http://secunia.com/advisories/36832 http://websecurity.com.ua/3528 http://www.securityfocus.com/archive/1/506704/100/0/threaded http://www.securityfocus.com/bid/36517 http://www.securitytracker.com/id?1022947 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.1EPSS: 2%CPEs: 68EXPL: 1

CVE-2009-1409 – e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection

https://notcve.org/view.php?id=CVE-2009-1409

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320. Una vulnerabilidad de inyección de SQL en usersettings.php en e107 v0.7.15 y anteriores, cuando la opción "Campos de usuario extendidos" está activado y magic_quotes_gpc está desactivado, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro Hide. Se trata de un vector diferente al de CVE-2005-4224 y CVE-2008-5320. • https://www.exploit-db.com/exploits/8495 http://osvdb.org/53812 http://secunia.com/advisories/34823 http://www.securityfocus.com/bid/34614 https://exchange.xforce.ibmcloud.com/vulnerabilities/49981 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2008-6208

https://notcve.org/view.php?id=CVE-2008-6208

Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name, (2) itemtitle, and (3) item parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en submitnews.php en e107 CMS v0.7.11 permite a atacantes remotos inyectar web script o HTML de su elección a través de los parámetros (1) author_name, (2) itemtitle, y (3) item. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos solamente a partir de la información de terceros. • http://www.juniper.net/security/auto/vulnerabilities/vuln28982.html http://www.securityfocus.com/bid/28982 https://exchange.xforce.ibmcloud.com/vulnerabilities/42248 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 56EXPL: 2

CVE-2008-5320 – e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection

https://notcve.org/view.php?id=CVE-2008-5320

SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter. Vulnerabilidad de inyección SQL en el archivo usersettings.php en e107 0.7.13 y versiones anteriores, permite a los usuarios remotos autentificados ejecutar arbitrariamente comandos SQL a través del parámetro ue[]. • https://www.exploit-db.com/exploits/6791 http://secunia.com/advisories/32322 http://securityreason.com/securityalert/4683 http://www.securityfocus.com/bid/31821 http://www.vupen.com/english/advisories/2008/2860 https://exchange.xforce.ibmcloud.com/vulnerabilities/45967 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •