CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000195
https://notcve.org/view.php?id=CVE-2017-1000195
October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server. La build 412 de October CMS es vulnerable a inyección de objetos PHP en el componente asset move, lo que resulta en la posibilidad de borrar archivos limitados por permisos de archivo en el servidor. • https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R317 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000196
https://notcve.org/view.php?id=CVE-2017-1000196
October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server. La build 412 de October CMS es vulnerable a la ejecución de código PHP en el componente asset manager, lo que resulta en el compromiso del sitio y, probablemente, de otras aplicaciones en el servidor. • https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R49 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000197
https://notcve.org/view.php?id=CVE-2017-1000197
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server. La build 412 de October CMS es vulnerable a modificación de rutas de archivo en el componente asset move, lo que resulta en la creación de archivos maliciosos en el servidor. • https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-eef90a4e3585febf6489916dc242d0ceR241 • CWE-417: Communication Channel Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16244 – OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2017-16244
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable. Existe Cross-Site Request Forgery (CSRF) en OctoberCMS 1.0.426 (también conocido como Build 426) debido a la validación incorrecta de tokens CSRF para la gestión de postback, lo que permite que un atacante consiga controlar la cuenta de la víctima. El ataque omite un mecanismo de protección que implica cabeceras X-CSRF y tokens CSRF mediante una determinada variable de postback _handler. OctoberCMS version 1.0.426 (Build 426) suffers from a cross site request forgery vulnerability. • https://www.exploit-db.com/exploits/43106 https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-15284 – OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-15284
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account. Existe Cross-Site Scripting (XSS) en OctoberCMS 1.0.425 (también conocido como Build 425), permitiendo que un usuario con los privilegios más bajos suba un archivo SVG que contenga código malicioso como el Avatar para el perfil. Cuando el Admin lo abre, provoca que se ejecute código JavaScript en el contexto de la cuenta Admin. OctoberCMS version 1.0.425 suffers from a stored cross site scripting vulnerability. • https://www.exploit-db.com/exploits/42978 https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2 https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •