CVSS: 6.0EPSS: 1%CPEs: 34EXPL: 0CVE-2009-4412
https://notcve.org/view.php?id=CVE-2009-4412
Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information. Vulnerabilidad de subida de ficheros sin restricciones Serendipity anterior v1.5 permite a usuarios utenticados remotamente ejecutar código de su elección por carga de un fichero con una extensión ejecutable seguida por una extensión segura, luego accede a él a través de una petición directa en un archivo en un directorio no especificado. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://blog.s9y.org/archives/211-Serendipity-1.5-released.html http://osvdb.org/61245 http://secunia.com/advisories/37830 http://www.openwall.com/lists/oss-security/2009/12/21/1 http://www.vupen.com/english/advisories/2009/3626 https://exchange.xforce.ibmcloud.com/vulnerabilities/54985 •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 2CVE-2008-1385 – S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1385
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Vulnerabilidad de secuencias de comandos en sitios cruzados en el plugin Top Referers (también conocido como referrer) de Serendipity (S9Y) anterior a 1.3.1 permite a atacantes remotos inyectar código web o HTML de su elección a través de una cabecera HTTP Referer. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • https://www.exploit-db.com/exploits/31682 http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1385-s9y.html http://secunia.com/advisories/29942 http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://excha • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2008-1386
https://notcve.org/view.php?id=CVE-2008-1386
Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited. Múltiples vulnerabilidad de ejecución de comandos en sitios cruzados en el instalador de Serendepity (S9Y) 1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) campos de ruta sin especificar o (2) el campo "host" de la base de datos. NOTA: la ventana de tiempo para vulnerar esta característica podría estar limitada. Serendipity version 1.3 suffers from cross site scripting vulnerabilities in the referrer plugin and installer. • http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html http://int21.de/cve/CVE-2008-1386-s9y.html http://www.securityfocus.com/archive/1/491176/100/0/threaded http://www.securityfocus.com/bid/28885 http://www.securitytracker.com/id?1019915 http://www.vupen.com/english/advisories/2008/1348/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41967 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •