Page 7 of 47 results (0.010 seconds)

CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 5

CVE-2012-4246 – phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-4246

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en lists/admin/index.php en phpList anterior a v2.10.19, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) page o (2) footer, (3) status, o (4) testtarget en la página send. • https://www.exploit-db.com/exploits/18419 http://www.phplist.com/?lid=579 https://www.httpcs.com/advisories https://www.httpcs.com/advisory/httpcs23 https://www.httpcs.com/advisory/httpcs24 https://www.httpcs.com/advisory/httpcs25 https://www.httpcs.com/advisory/httpcs26 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 1

CVE-2012-4247 – phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-4247

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en lists/admin/index.php en phpList anterior a v2.10.19, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, o (5) remote_prefix para la página import4; o (6) parámetro id para la página bouncerule. • https://www.exploit-db.com/exploits/18419 http://www.phplist.com/?lid=579 https://www.httpcs.com/advisories https://www.httpcs.com/advisory/httpcs1 https://www.httpcs.com/advisory/httpcs2 https://www.httpcs.com/advisory/httpcs3 https://www.httpcs.com/advisory/httpcs4 https://www.httpcs.com/advisory/httpcs6 https://www.httpcs.com/advisory/httpcs7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 2.6EPSS: 4%CPEs: 23EXPL: 3

CVE-2012-3952 – phpList 2.10.18 - 'unconfirmed' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-3952

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en admin/index.php en phpList anterior a v2.10.19 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro unconfirmed para la página user. phpList version 2.10.18 suffers from cross site scripting and remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/37590 http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html http://osvdb.org/84482 http://secunia.com/advisories/50150 http://www.phplist.com/?lid=579 http://www.securityfocus.com/bid/54887 https://exchange.xforce.ibmcloud.com/vulnerabilities/77526 https://www.htbridge.com/advisory/HTB23100 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 4

CVE-2012-3953 – phpList 2.10.18 - 'index.php' SQL Injection

https://notcve.org/view.php?id=CVE-2012-3953

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page. Vulnerabilidad de inyección SQL en admin/index.php en phpList anterior a v2.10.19, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro delete para la página editattributes. phpList version 2.10.18 suffers from cross site scripting and remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/37613 http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html http://osvdb.org/84483 http://www.phplist.com/?lid=579 https://exchange.xforce.ibmcloud.com/vulnerabilities/77527 https://www.htbridge.com/advisory/HTB23100 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 75EXPL: 1

CVE-2011-1682 – phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2011-1682

Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists because of an incomplete fix for CVE-2011-0748. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en phpList v2.10.13 y anteriores permiten a atacantes remotos secuestras la autenticación de los adminitradores para peticiones que (1) creen una lista o (2) inserten secuencias de comandos en sitios cruzados (XSS). NOTA: esta vulnerabilidad existe por una solución incompleta de CVE-2011-0748. • https://www.exploit-db.com/exploits/18419 http://secunia.com/advisories/44041 https://exchange.xforce.ibmcloud.com/vulnerabilities/66666 https://exchange.xforce.ibmcloud.com/vulnerabilities/66816 • CWE-352: Cross-Site Request Forgery (CSRF) •