CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8979
https://notcve.org/view.php?id=CVE-2019-8979
Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled. Kohana, hasta la versión 3.3.6, tiene una inyección SQL cuando el parámetro order_by() puede controlarse. • https://github.com/huzr2018/orderby_SQLi • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2016-10510
https://notcve.org/view.php?id=CVE-2016-10510
Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el componente de seguridad de Kohana en versiones anteriores a la 3.3.6 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios al omitir el mecanismo de protección de strip_image_tags en system/classes/Kohana/Security.php. • https://advisory.checkmarx.net/advisory/CX-2016-4451 https://github.com/kohana/kohana/issues/107 https://github.com/kohana/kohana/releases/tag/v3.3.6 https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2014-8684 – Seagate Business NAS - Remote Command Execution
https://notcve.org/view.php?id=CVE-2014-8684
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes. CodeIgniter antes de la versión 3.0 y Kohana 3.2.3 y anteriores y en versiones 3.3.x hasta la 3.3.2 facilita que los atacantes remotos suplanten cookies de sesión y lleven a cabo ataques de inyección de objetos PHP. Esto se realizaría por medio de operadores estándar de comparación de strings para comparar hashes criptográficos. • https://www.exploit-db.com/exploits/36264 http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html http://seclists.org/fulldisclosure/2014/May/54 https://github.com/kohana/core/pull/492 https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection http://www.seagate.com/au/en/support/external-hard-drives/network-storage/business-storage-2-bay-nas https://beyondbinary.io/advisory/seagate-nas-rce • CWE-310: Cryptographic Issues •