Page 4 of 36 results (0.003 seconds)

CVSS: 5.3EPSS: 6%CPEs: 29EXPL: 2

CVE-2014-8775 – MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-8775

03 Dec 2014 — MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. MODX Revolution 2.x anterior a 2.2.15 no incluye el indicador HTTPOnly en una cabecera de fijar la cookie en la cookie de la sesión, lo que facilita a atacantes remotos obtener información potencialmente sensible a través del acceso de secuencias de comandos a esta cookie. • https://www.exploit-db.com/exploits/35159 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 5

CVE-2014-5451 – MODX Revolution 2.3.1-pl Cross Site Scripting

https://notcve.org/view.php?id=CVE-2014-5451

17 Sep 2014 — Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression. Vulnerabilidad de XSS en manager/templates/default/header.tpl en MODX Revolution 2.3.1-pl y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro 'a' en manager/. NOTA... • https://packetstorm.news/files/id/128302 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 28EXPL: 1

CVE-2014-2736 – MODx Blind SQL Injection

https://notcve.org/view.php?id=CVE-2014-2736

21 Apr 2014 — Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php. Múltiples vulnerabilidades de inyección SQL en MODX Revolution anterior a 2.2.14 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de (1) ID de se... • https://packetstorm.news/files/id/126248 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0

CVE-2014-2311

https://notcve.org/view.php?id=CVE-2014-2311

11 Mar 2014 — SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en modx.class.php en MODX Revolution 2.0.0 anterior a 2.2.13 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 26EXPL: 1

CVE-2014-2080

https://notcve.org/view.php?id=CVE-2014-2080

28 Feb 2014 — Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter. Vulnerabilidad de XSS en manager/templates/default/header.tpl en ModX Revolution en versiones anteriores a 2.2.11 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro "a". • http://modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 23%CPEs: 1EXPL: 1

CVE-2010-5278 – MODx manager - '/controllers/default/resource/tvs.php?class_key' Traversal Local File Inclusion

https://notcve.org/view.php?id=CVE-2010-5278

07 Oct 2012 — Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de salto de directorio en manager/controllers/default/resource/tvs.php n MODx Revolution v2.0.2-pl, y posiblemente anteriores, cuando está deshabilitado magic_quot... • https://www.exploit-db.com/exploits/34788 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •