CVSS: 7.5EPSS: 2%CPEs: 41EXPL: 2CVE-2010-1916
https://notcve.org/view.php?id=CVE-2010-1916
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin. La funcionalidad de configuración dinámica del editor Xinha WYSIWYG v0.96 Beta 2 y anteriores, como la utilizada en Serendipity v1.5.2 y anteriores, permite a atacantes remotos evitar las restricciones de acceso pretendidas y modificar la configuración de complementos -plugins- de su elección mediante (1) los parámetros modificados backend_config_secret_key_location y backend_config_hash que se utilizan en un hash SHA1 de un secreto compartido que pueden ser conocidos o influenciados externamente, los cuales no son manejados adecuadamente por la funcionalidad "Deprecated config passing"; o (2) las variables manipuladas backend_data y backend_data[key_location], las cuales no son manejadas adecuadamente por la función xinha_read_passed_data. NOTA: Esto puede ser aprovechado para subir y puede que ejecutar los ficheros que se deseen mediante el fichero config.inc.php del complemento ImageManager plugin. • http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html http://secunia.com/advisories/39782 http://secunia.com/advisories/40124 http://trac.xinha.org/ticket/1518 http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html http://www.securityfocus.com/bid/40033 http://www.vupen&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 1%CPEs: 34EXPL: 0CVE-2009-4412
https://notcve.org/view.php?id=CVE-2009-4412
Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information. Vulnerabilidad de subida de ficheros sin restricciones Serendipity anterior v1.5 permite a usuarios utenticados remotamente ejecutar código de su elección por carga de un fichero con una extensión ejecutable seguida por una extensión segura, luego accede a él a través de una petición directa en un archivo en un directorio no especificado. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://blog.s9y.org/archives/211-Serendipity-1.5-released.html http://osvdb.org/61245 http://secunia.com/advisories/37830 http://www.openwall.com/lists/oss-security/2009/12/21/1 http://www.vupen.com/english/advisories/2009/3626 https://exchange.xforce.ibmcloud.com/vulnerabilities/54985 •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 2CVE-2008-1385 – S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1385
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Vulnerabilidad de secuencias de comandos en sitios cruzados en el plugin Top Referers (también conocido como referrer) de Serendipity (S9Y) anterior a 1.3.1 permite a atacantes remotos inyectar código web o HTML de su elección a través de una cabecera HTTP Referer. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • https://www.exploit-db.com/exploits/31682 http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1385-s9y.html http://secunia.com/advisories/29942 http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://excha • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2008-1386
https://notcve.org/view.php?id=CVE-2008-1386
Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited. Múltiples vulnerabilidad de ejecución de comandos en sitios cruzados en el instalador de Serendepity (S9Y) 1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) campos de ruta sin especificar o (2) el campo "host" de la base de datos. NOTA: la ventana de tiempo para vulnerar esta característica podría estar limitada. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1386-s9y.html http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41967 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2008-1476
https://notcve.org/view.php?id=CVE-2008-1476
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Serendipity (S9Y) antes de 1.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados relacionados con trackbacks recibidos. • http://blog.s9y.org/archives/192-Serendipity-1.3-released-addresses-security.html http://secunia.com/advisories/29398 http://secunia.com/advisories/29502 http://www.debian.org/security/2008/dsa-1528 http://www.securityfocus.com/bid/28298 http://www.vupen.com/english/advisories/2008/0925/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41343 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •