Page 5 of 55 results (0.006 seconds)

CVSS: 3.5EPSS: 0%CPEs: 20EXPL: 0

CVE-2010-0997

https://notcve.org/view.php?id=CVE-2010-0997

Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados en 107_plugins/content/content_manager.php en el complemento -plugin- Content Management de e107 anterior a v0.7.20, cuando el gestor de contenido personal está habilitado, permite a usuarios autenticados en remoto asistidos por usuarios locales inyectar secuencias de comandos Web o HTML mediante el parámetro content_heading. • http://e107.org/comment.php?comment.news.864 http://e107.org/svn_changelog.php?version=0.7.20 http://secunia.com/advisories/39013 http://secunia.com/secunia_research/2010-43 http://www.securityfocus.com/archive/1/510809/100/0/threaded http://www.securityfocus.com/bid/39539 http://www.vupen.com/english/advisories/2010/0919 https://exchange.xforce.ibmcloud.com/vulnerabilities/57933 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0

CVE-2009-4083

https://notcve.org/view.php?id=CVE-2009-4083

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) submitnews.php, (2) usersettings.php; and (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, and (11) mailout.php in e107_admin/. NOTE: this may overlap CVE-2004-2040 and CVE-2006-4794, but there are insufficient details to be certain. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados(XSS) en e107 v0.7.16 y anteriores permite a atacantes remotos permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados en (1) submitnews.php, (2) usersettings.php; y (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, y(11) mailout.php en e107_admin/. NOTA: esta vulnerabilidad puede solaparse con CVE-2004-2040 y CVE-2006-4794, pero no hay suficientes detalles para tener certeza. • http://blog.bkis.com/e107-multiple-vulnerabilities http://www.securityfocus.com/archive/1/508007/100/0/threaded http://www.securityfocus.com/bid/37087 https://exchange.xforce.ibmcloud.com/vulnerabilities/54372 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 58EXPL: 0

CVE-2009-4084

https://notcve.org/view.php?id=CVE-2009-4084

SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la característica de búsqueda en e107 v0.7.16 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores vectores no especificados. • http://blog.bkis.com/e107-multiple-vulnerabilities http://www.securityfocus.com/archive/1/508007/100/0/threaded http://www.securityfocus.com/bid/37087 https://exchange.xforce.ibmcloud.com/vulnerabilities/54373 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 2

CVE-2009-3444 – e107 0.7.16 - Referer header Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2009-3444

Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en email.php en e107 v0.7.16 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de la cabecera HTTP Referer en una acción news.1 (también conocida como noticias (news) a correo (email). • https://www.exploit-db.com/exploits/9825 http://osvdb.org/58363 http://secunia.com/advisories/36832 http://websecurity.com.ua/3528 http://www.securityfocus.com/archive/1/506704/100/0/threaded http://www.securityfocus.com/bid/36517 http://www.securitytracker.com/id?1022947 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.1EPSS: 1%CPEs: 68EXPL: 1

CVE-2009-1409 – e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection

https://notcve.org/view.php?id=CVE-2009-1409

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320. Una vulnerabilidad de inyección de SQL en usersettings.php en e107 v0.7.15 y anteriores, cuando la opción "Campos de usuario extendidos" está activado y magic_quotes_gpc está desactivado, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro Hide. Se trata de un vector diferente al de CVE-2005-4224 y CVE-2008-5320. • https://www.exploit-db.com/exploits/8495 http://osvdb.org/53812 http://secunia.com/advisories/34823 http://www.securityfocus.com/bid/34614 https://exchange.xforce.ibmcloud.com/vulnerabilities/49981 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •