CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-7303
https://notcve.org/view.php?id=CVE-2013-7303
Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field. Múltiples vulnerabilidades de XSS en (1) squelettes-dist/formulaires/inscription.php y (2) prive/forms/editer_auteur.php de SPIP anterior a la versión 2.1.25 y 3.0.x anterior a 3.0.13 permite a atacantes remotos inyectar script Web o HTML arbitrario a través del campo de nombre de autor. • http://core.spip.org/projects/spip/repository/revisions/20902 http://seclists.org/oss-sec/2014/q1/123 http://seclists.org/oss-sec/2014/q1/128 http://secunia.com/advisories/56381 http://www.securitytracker.com/id/1029703 http://www.spip.net/fr_article5648.html http://www.spip.net/fr_article5665.html http://zone.spip.org/trac/spip-zone/changeset/77768 https://exchange.xforce.ibmcloud.com/vulnerabilities/90643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 46EXPL: 1CVE-2013-4555
https://notcve.org/view.php?id=CVE-2013-4555
Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors. Vulnerabilidad de CSRF en ecrire/action/logout.php de SPIP anterior a la versión 2.1.24 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios por solicitudes que cierren la sesión del usuario a través de vectores sin especificar. • http://core.spip.org/projects/spip/repository/revisions/20874 http://secunia.com/advisories/55551 http://www.openwall.com/lists/oss-security/2013/11/10/4 http://www.securitytracker.com/id/1029317 http://www.spip.net/fr_article5646.html https://www.debian.org/security/2013/dsa-2794 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0CVE-2013-4556
https://notcve.org/view.php?id=CVE-2013-4556
Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter. Vulnerabilidad de XSS en la página de autor (prive/formulaires/editer_auteur.php) de SPIP anterior a la versión 2.1.24 y 3.0.x anterior a 3.0.12 permite a atacantes remotos inyectar script web o HTML arbitrario a través del parámetro url_site. • http://core.spip.org/projects/spip/repository/revisions/20879 http://core.spip.org/projects/spip/repository/revisions/20880 http://secunia.com/advisories/55551 http://www.openwall.com/lists/oss-security/2013/11/10/4 http://www.securitytracker.com/id/1029317 http://www.spip.net/fr_article5646.html http://www.spip.net/fr_article5648.html https://www.debian.org/security/2013/dsa-2794 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2008-5812
https://notcve.org/view.php?id=CVE-2008-5812
Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en SPIP v1.8 anteriores a v1.8.3b, 1.9 anteriores a v1.9.2g y v2.0 anteriores a v2.0.2 tienen un impacto y vectores de ataque desconocidos. • http://secunia.com/advisories/33307 http://www.securityfocus.com/bid/33061 http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/47695 •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2008-5813
https://notcve.org/view.php?id=CVE-2008-5813
SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en inc/rubriques.php en SPIP v1.8 anteriores a v1.8.3b, v1.9 anteriores a v1.9.2g, y v2.0 anteriores a v2.0.2 permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "ID". NOTA: algunos de los detalles han sido obtenidos a partir de la información de terceros. • http://secunia.com/advisories/33307 http://www.securityfocus.com/bid/33021 http://www.securityfocus.com/bid/33061 http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/47626 https://exchange.xforce.ibmcloud.com/vulnerabilities/47695 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •