Page 5 of 29 results (0.007 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-6588 – MODX Login Extra Cross Site Scripting

https://notcve.org/view.php?id=CVE-2015-6588

Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en login-fsp.html en MODX Revolution en versiones anteriores a la 1.9.01 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro QUERY_STRING. MODX Login Extra versions prior to 1.9.1 suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/134529/MODX-2.3.5-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 29EXPL: 2

CVE-2014-8773 – MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-8773

MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter. MODX Revolution 2.x anterior a 2.2.15 permite a atacantes remotos evadir el mecanismo de protección de CSRF mediante la (1) omisión del token CSRF o a través de una (2) cadena larga en el parámetro del token CSRF. • https://www.exploit-db.com/exploits/35159 http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior http://hacktivity.websecgeeks.com/modx-csrf-and-xss • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 5.0EPSS: 0%CPEs: 29EXPL: 2

CVE-2014-8775 – MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-8775

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. MODX Revolution 2.x anterior a 2.2.15 no incluye el indicador HTTPOnly en una cabecera de fijar la cookie en la cookie de la sesión, lo que facilita a atacantes remotos obtener información potencialmente sensible a través del acceso de secuencias de comandos a esta cookie. • https://www.exploit-db.com/exploits/35159 http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior http://hacktivity.websecgeeks.com/modx-csrf-and-xss • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 29EXPL: 2

CVE-2014-8774 – MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-8774

Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter. Vulnerabilidad de XSS en manager/index.php en MODX Revolution 2.x anterior a 2.2.15 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro context_key. • https://www.exploit-db.com/exploits/35159 http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior http://hacktivity.websecgeeks.com/modx-csrf-and-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 4

CVE-2014-5451 – MODX Revolution 2.3.1-pl Cross Site Scripting

https://notcve.org/view.php?id=CVE-2014-5451

Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression. Vulnerabilidad de XSS en manager/templates/default/header.tpl en MODX Revolution 2.3.1-pl y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro 'a' en manager/. NOTA: este problema existe debido a una regresión de CVE-2014-2080. MODX Revolution version 2.3.1-pl suffers from a reflective cross site scripting vulnerability. • http://packetstormsecurity.com/files/128302/MODX-Revolution-2.3.1-pl-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/533466/100/0/threaded http://www.securityfocus.com/bid/69884 https://github.com/modxcms/revolution/commit/e36f80f18e9514204bf2ce82747c8adf7e47a9c9 https://www.htbridge.com/advisory/HTB23229 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •