CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44118
https://notcve.org/view.php?id=CVE-2021-44118
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS). SPIP versión 4.0.0 está afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS). Para explotar la vulnerabilidad, un visitante debe navegar a un archivo SVG malicioso. • https://git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbba https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-28984
https://notcve.org/view.php?id=CVE-2020-28984
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters. El archivo prive/formulaires/configurer_preferences.php en SPIP versión anterior a 3.2.8, no valida correctamente los parámetros couleur, display, display_navigation, display_outils, imessage y spip_ecran • https://git.spip.net/spip/spip/commit/ae4267eba1022dabc12831ddb021c5d6e09040f8 https://git.spip.net/spip/spip/compare/v3.2.7...v3.2.8 https://lists.debian.org/debian-lts-announce/2020/12/msg00036.html https://www.debian.org/security/2020/dsa-4798 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-19830
https://notcve.org/view.php?id=CVE-2019-19830
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. El archivo _core_/plugins/medias en SPIP versiones 3.2.x anteriores a la versión 3.2.7, permite a autores autenticados remotos inyectar contenido de la base de datos. • https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69 https://usn.ubuntu.com/4536-1 https://www.debian.org/security/2019/dsa-4583 https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-16391
https://notcve.org/view.php?id=CVE-2019-16391
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php. SPIP versiones anteriores a 3.1.11 y versiones 3.2 anteriores a 3.2.5, permite a visitantes autenticados modificar cualquier contenido publicado y ejecutar otras modificaciones en la base de datos. Esto está • https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html?lang=fr https://git.spip.net/SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79 https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00ea78eacdb8f76aa5f66 https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html https://seclists.org/bugtraq/2019/Sep/40 https://usn.ubuntu •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-16392
https://notcve.org/view.php?id=CVE-2019-16392
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. SPIP versiones anteriores a 3.1.11 y versiones 3.2 anteriores a 3.2.5, permite un ataque de tipo XSS del archivo prive/formulaires/login.php por medio de mensajes de error. • https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html https://git.spip.net/SPIP/spip/commit/3c12a82c7d9d4afd09e708748fa82e7836174028 https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html https://seclists.org/bugtraq/2019/Sep/40 https://usn.ubuntu.com/4536-1 https://www.debian.org/security/2019/dsa-4532 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •