CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9960 – LimeSurvey Zip Path Traversals
https://notcve.org/view.php?id=CVE-2019-9960
24 Mar 2019 — The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. La función downloadZip en application/controllers/admin/export.php en LimeSurvey, hasta la versión 3.16.1+190225, permite una ruta relativa. • https://github.com/LimeSurvey/LimeSurvey/commit/1ed10d3c423187712b8f6a8cb2bc9d5cc3b2deb8 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-18358
https://notcve.org/view.php?id=CVE-2017-18358
15 Jan 2019 — LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin panel. LimeSurvey en versiones anteriores a la 2.72.4 tiene Cross-Site Scripting (XSS) persistente mediante el uso de la característica "Continue Later" (también conocida como "Resume later") para introducir una dirección de correo electrónico, que se gestiona de manera incorrecta en el panel de administración. • https://blog.ripstech.com/2018/limesurvey-persistent-xss-to-code-execution • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20322
https://notcve.org/view.php?id=CVE-2018-20322
21 Dec 2018 — LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6. LimeSurvey, en su versión 3.15.5, contiene una vulnerabilidad de Cross Site Scripting (XSS) en la subida del zip "Survey Resource" que puede resultar en la ejecución de código JavaScript contra los administradores de LimeSurvey. Esto se solucionó en la versión 3.15.6. • https://bugs.limesurvey.org/view.php?id=14376 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17003 – LimeSurvey 3.14.7 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-17003
19 Sep 2018 — In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert. En LimeSurvey 3.14.7, se han descubierto una inyección HTML y Cross-Site Scripting (XSS) persistente en el apéndice mediante el parámetro surveyls_title en /index.php?r=admin/survey/sa/insert. LimeSurvey version 3.14.7 suffers from cross site scripting and html injection vulnerabilities. • http://packetstormsecurity.com/files/149435/LimeSurvey-3.14.7-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 10%CPEs: 2EXPL: 2CVE-2018-17057 – LimeSurvey < 3.16 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-17057
14 Sep 2018 — An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper. Se ha descubierto un problema en TCPDF en versiones anteriores a la 6.2.22. Los atacantes pueden desencadenar la deserialización de datos arbitrarios mediante el wrapper phar: . TCPDF versions 6.2.19 and below suffer from a deserialization vulnerability that can allow for remote code execution. • https://www.exploit-db.com/exploits/46634 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000658
https://notcve.org/view.php?id=CVE-2018-1000658
06 Sep 2018 — LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4. LimeSurvey en versiones anteriores a la 3.14.4 contie... • https://github.com/LimeSurvey/LimeSurvey/commit/20fc85edccc80e7e7f162613542792380c44446a • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000659
https://notcve.org/view.php?id=CVE-2018-1000659
06 Sep 2018 — LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4. LimeSurvey en su versión 3.14.4 y an... • https://github.com/LimeSurvey/LimeSurvey/commit/72a02ebaaf95a80e26127ee7ee2b123cccce05a7 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16397
https://notcve.org/view.php?id=CVE-2018-16397
03 Sep 2018 — In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file, En LimeSurvey en versiones anteriores a la 3.14.7, un usuario administrador puede aprovechar una pregunta "file upload" para leer un archivo arbitrario. • https://github.com/LimeSurvey/LimeSurvey/blob/3be9b41e76826b57f5860d18d93b23f47d59d2e4/docs/release_notes.txt#L51 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000514
https://notcve.org/view.php?id=CVE-2018-1000514
26 Jun 2018 — LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x. LimeSurvey 3.0.0-beta.3+17110 contiene una vulnerabilidad de Cross-Site Request Forgery (CSRF) en Boxes que puede resultar en un CSRF que provoque que los administradores CSRF eliminen las boxes. La vulnerabilidad parece haber sido solucionada en las versiones 3.6.x. • https://bugs.limesurvey.org/plugin.php?page=Source/view&id=26925 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000513
https://notcve.org/view.php?id=CVE-2018-1000513
26 Jun 2018 — LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x. LimeSurvey, en su versión 3.0.0-beta.3+17110, contiene una vulnerabilidad de Cross Site Scripting (XSS) en Boxes que puede resultar en la ejecución de código JavaScript contra los administradores de LimeSurvey. La vulnerabilidad parece haber sido solucionada en las versiones 3.6.x. • https://bugs.limesurvey.org/view.php?id=13560 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •