CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4037
https://notcve.org/view.php?id=CVE-2014-4037
Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a different issue than CVE-2012-4000. Vulnerabilidad de XSS en editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php en FCKeditor anterior a 2.6.11 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una clave de array en el parámetro textinputs[], un problema diferente a CVE-2012-4000. • http://ckeditor.com/blog/FCKeditor-2.6.11-Released http://packetstormsecurity.com/files/126902/FCKeditor-2.6.10-Cross-Site-Scripting.html http://www.securitytracker.com/id/1030413 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 53EXPL: 3CVE-2012-4000 – FCKEditor Core - 'Editor 'spellchecker.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4000
Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función print_textinputs_var en editor editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php en FCKeditor v2.6.7 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros de matriz de 'textinputs'. • https://www.exploit-db.com/exploits/37457 http://disse.cting.org/blog/2012/06/22/fckeditor-reflected-xss-vulnerability http://secunia.com/advisories/49606 http://www.debian.org/security/2012/dsa-2522 http://www.securityfocus.com/bid/54188 https://exchange.xforce.ibmcloud.com/vulnerabilities/76604 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0CVE-2009-2324
https://notcve.org/view.php?id=CVE-2009-2324
Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory. Múltiples vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en FCKeditor anterior a v2.6.4.1, permite a atacantes remotos inyectar secuencias de comandos Web o HTML utilizando componentes en el directorio samples (también conocido como _samples). • http://www.ocert.org/advisories/ocert-2009-007.html http://www.securityfocus.com/archive/1/504721/100/0/threaded http://www.securitytracker.com/id?1022513 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 97%CPEs: 27EXPL: 5CVE-2009-2265 – Adobe ColdFusion 8 - Remote Command Execution (RCE)
https://notcve.org/view.php?id=CVE-2009-2265
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory. Múltiples vulnerabilidades de salto de directorio en FCKeditor anterior a v2.6.4.1, permiten a atacantes remotos crear ficheros ejecutables en directorios de su elección a través de secuencias de salto de directorio en la entrada de módulos conectores no especificados, tal como se ha explotado en Julio 2009. Está relacionado con el fichero de navegación y el directorio editor/filemanager/connectors/. • https://www.exploit-db.com/exploits/50057 https://www.exploit-db.com/exploits/16788 https://github.com/0xConstant/CVE-2009-2265 https://github.com/p1ckzi/CVE-2009-2265 https://github.com/N3rdyN3xus/CVE-2009-2265 http://isc.sans.org/diary.html?storyid=6724 http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html http://secunia.com/advisories/35833 http://secunia.com/advisories/3 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 5%CPEs: 11EXPL: 3CVE-2008-6178 – Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-6178
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of these details are obtained from third party information. Vulnerabilidad de envío de archivo no restringido en editor/filemanager/browser/default/connectors/php/connector.php en FCKeditor v2.2 en Falt4 CMS, Nuke ET, y otros productos, lo que permite a atacantes remotos ejecutar codigo a su eleccion mediante la creacion de un fichero con secuencias PHP precedidas de un encabezado ZIP, subiendo este fichero a traves la accion FileUpload, y despues accediendo al fichero a traves de una peticion directa del fichero en UserFiles/File/, probablemente relacionado con CVE-2005-4094. NOTA: Algunos detalles fueron obtenidos de una tercera parte. • https://www.exploit-db.com/exploits/8060 https://www.exploit-db.com/exploits/6783 http://secunia.com/advisories/33973 http://www.securityfocus.com/bid/31812 http://www.vupen.com/english/advisories/2009/0447 https://exchange.xforce.ibmcloud.com/vulnerabilities/48769 • CWE-94: Improper Control of Generation of Code ('Code Injection') •