CVSS: 7.5EPSS: 7%CPEs: 18EXPL: 2CVE-2009-3041 – SPIP < 2.0.9 - Arbitrary Copy All Passwords to '.XML' File
https://notcve.org/view.php?id=CVE-2009-3041
SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009. SPIP v1.9 anterior v1.9.2i y v2.0.x hasta 2.0.8 no usa propiedades de control de acceso para 1) ecrire/exec/install.php y(2) ecrire/index.php, permitiendo a atacantes remotos dirigir actividades no autorizadas relacionadas con la instalación y copias de seguridad, tal como se ha explotado en Agosto de 2009. • https://www.exploit-db.com/exploits/9448 http://fil.rezo.net/secu-14346-14350+14354.patch http://secunia.com/advisories/36365 http://www.securityfocus.com/bid/36008 http://www.spip-contrib.net/SPIP-Security-Alert-new-version https://exchange.xforce.ibmcloud.com/vulnerabilities/52381 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2008-5812
https://notcve.org/view.php?id=CVE-2008-5812
Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en SPIP v1.8 anteriores a v1.8.3b, 1.9 anteriores a v1.9.2g y v2.0 anteriores a v2.0.2 tienen un impacto y vectores de ataque desconocidos. • http://secunia.com/advisories/33307 http://www.securityfocus.com/bid/33061 http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/47695 •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2008-5813
https://notcve.org/view.php?id=CVE-2008-5813
SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en inc/rubriques.php en SPIP v1.8 anteriores a v1.8.3b, v1.9 anteriores a v1.9.2g, y v2.0 anteriores a v2.0.2 permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "ID". NOTA: algunos de los detalles han sido obtenidos a partir de la información de terceros. • http://secunia.com/advisories/33307 http://www.securityfocus.com/bid/33021 http://www.securityfocus.com/bid/33061 http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/47626 https://exchange.xforce.ibmcloud.com/vulnerabilities/47695 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2006-0519
https://notcve.org/view.php?id=CVE-2006-0519
SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message. • http://secunia.com/advisories/18676 http://www.vupen.com/english/advisories/2006/0398 http://www.zone-h.org/en/advisories/read/id=8650 https://exchange.xforce.ibmcloud.com/vulnerabilities/24399 •
CVSS: 7.5EPSS: 2%CPEs: 2EXPL: 1CVE-2006-0517
https://notcve.org/view.php?id=CVE-2006-0517
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions". • http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0990.html http://secunia.com/advisories/18676 http://securityreason.com/securityalert/395 http://securitytracker.com/id?1015556 http://www.osvdb.org/22844 http://www.osvdb.org/22845 http://www.osvdb.org/22848 http://www.securityfocus.com/archive/1/423655/100/0/threaded http://www.securityfocus.com/bid/16458 http://www.securityfocus.com/bid/24397 http://www.vupen.com/english/advisories/2006/0398 http://www •