CVSS: 9.8EPSS: 0%CPEs: 35EXPL: 0CVE-2012-2762
https://notcve.org/view.php?id=CVE-2012-2762
07 Jun 2012 — SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php. Vulnerabilidad de inyección SQL en include/functions_trackbacks.inc.php en Serendipity v1.6.2 permite a atacantes remotos ejecutar comandos SQL a través del parámetro URL en comment.php. • http://blog.s9y.org/archives/241-Serendipity-1.6.2-released.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3800
https://notcve.org/view.php?id=CVE-2011-3800
24 Sep 2011 — Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files. Serendipity v1.5.5 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con templates/newspaper/layout.php y algunos otros archivos. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 54EXPL: 1CVE-2010-2957
https://notcve.org/view.php?id=CVE-2010-2957
10 Sep 2010 — Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Serendipity anteriores a v1.5.4, cuando el login "Remenber me" está activado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores desconocidos. • http://blog.s9y.org/archives/223-Serendipity-1.5.4-released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 41EXPL: 2CVE-2010-1916
https://notcve.org/view.php?id=CVE-2010-1916
12 May 2010 — The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backen... • http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 2%CPEs: 34EXPL: 0CVE-2009-4412
https://notcve.org/view.php?id=CVE-2009-4412
24 Dec 2009 — Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information. Vulnerabilidad de subida de ficheros sin restricciones Serendipity anterior v1.5 permite a usuarios utenticados remotamente ejecutar código de su elección po... • http://blog.s9y.org/archives/211-Serendipity-1.5-released.html •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3337
https://notcve.org/view.php?id=CVE-2009-3337
24 Sep 2009 — SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQL commands via an unspecified parameter associated with Meta keywords in a blog entry. Vulnerabilidad de inyección SQL en el complemento reetag (serendipity_event_freetag) anteriores a v3.09 para Serendipity (S9Y), permite a atacantes remotos ejecutar comandos SQL de su elección a través de un parámetro no especificado asociado con la clave METE en un... • http://blog.s9y.org/archives/210-Security-update-for-Freetag-Plugin.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 7%CPEs: 27EXPL: 2CVE-2008-1385 – S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1385
23 Apr 2008 — Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Vulnerabilidad de secuencias de comandos en sitios cruzados en el plugin Top Referers (también conocido como referrer) de Serendipity (S9Y) anterior a 1.3.1 permite a atacantes remotos inyectar código web o HTML de su elección a través de una cabecera HTTP Referer. • https://www.exploit-db.com/exploits/31682 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2008-1386
https://notcve.org/view.php?id=CVE-2008-1386
23 Apr 2008 — Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited. Múltiples vulnerabilidad de ejecución de comandos en sitios cruzados en el instalador de Serendepity (S9Y) 1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) campos de ruta sin e... • http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 34EXPL: 0CVE-2008-0124
https://notcve.org/view.php?id=CVE-2008-0124
28 Feb 2008 — Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Serendipity (S9Y) anterior a 1.3-beta 1, permite a usuarios autenticados remotamente inyectar secuencias de comandos Web de su ... • http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2008-0751 – S9Y Serendipity Freetag-plugin 2.95 - 'style' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-0751
13 Feb 2008 — Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/. Vulnerabilidad de Sitios cruzados en Freetag previa a la v2.96 para S9Y Serendipity, usado con Internet explorer 6 o 7, permite a atacantes remotos inyectar código web o HTML de su elección a través del PATH_INFO a plugin/tag/. • https://www.exploit-db.com/exploits/31126 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •