CVSS: 6.0EPSS: 1%CPEs: 34EXPL: 0CVE-2009-4412
https://notcve.org/view.php?id=CVE-2009-4412
Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information. Vulnerabilidad de subida de ficheros sin restricciones Serendipity anterior v1.5 permite a usuarios utenticados remotamente ejecutar código de su elección por carga de un fichero con una extensión ejecutable seguida por una extensión segura, luego accede a él a través de una petición directa en un archivo en un directorio no especificado. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://blog.s9y.org/archives/211-Serendipity-1.5-released.html http://osvdb.org/61245 http://secunia.com/advisories/37830 http://www.openwall.com/lists/oss-security/2009/12/21/1 http://www.vupen.com/english/advisories/2009/3626 https://exchange.xforce.ibmcloud.com/vulnerabilities/54985 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2008-1386
https://notcve.org/view.php?id=CVE-2008-1386
Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited. Múltiples vulnerabilidad de ejecución de comandos en sitios cruzados en el instalador de Serendepity (S9Y) 1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) campos de ruta sin especificar o (2) el campo "host" de la base de datos. NOTA: la ventana de tiempo para vulnerar esta característica podría estar limitada. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1386-s9y.html http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41967 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 2CVE-2008-1385 – S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1385
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Vulnerabilidad de secuencias de comandos en sitios cruzados en el plugin Top Referers (también conocido como referrer) de Serendipity (S9Y) anterior a 1.3.1 permite a atacantes remotos inyectar código web o HTML de su elección a través de una cabecera HTTP Referer. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • https://www.exploit-db.com/exploits/31682 http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1385-s9y.html http://secunia.com/advisories/29942 http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://excha • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2008-1476
https://notcve.org/view.php?id=CVE-2008-1476
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Serendipity (S9Y) antes de 1.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados relacionados con trackbacks recibidos. • http://blog.s9y.org/archives/192-Serendipity-1.3-released-addresses-security.html http://secunia.com/advisories/29398 http://secunia.com/advisories/29502 http://www.debian.org/security/2008/dsa-1528 http://www.securityfocus.com/bid/28298 http://www.vupen.com/english/advisories/2008/0925/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41343 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 0CVE-2008-0124
https://notcve.org/view.php?id=CVE-2008-0124
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Serendipity (S9Y) anterior a 1.3-beta 1, permite a usuarios autenticados remotamente inyectar secuencias de comandos Web de su elección o HTML a través de (1) el campo "Real name" de Personal Settings, el cuál es mostrado a los lectores de los artículos; o (2) la subida de un fichero, como se ha demostrado mediante un fichero .htm, .html, o .js. • http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html http://int21.de/cve/CVE-2008-0124-s9y.html http://secunia.com/advisories/29128 http://secunia.com/advisories/29502 http://www.debian.org/security/2008/dsa-1528 http://www.securityfocus.com/bid/28003 http://www.securitytracker.com/id?1019502 http://www.vupen.com/english/advisories/2008/0700/references https://exchange.xforce.ibmcloud.com/vulnerabilities/40851 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •