4 results (0.004 seconds)

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-33178 – Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter

https://notcve.org/view.php?id=CVE-2023-33178

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. • https://claroty.com/team82/disclosure-dashboard https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-g9x2-757j-hmhh https://xibosignage.com/blog/security-advisory-2023-05 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2

CVE-2013-4888 – Xibo - 'layout' HTML Injection

https://notcve.org/view.php?id=CVE-2013-4888

Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page. Vulnerabilidad de XSS en index.php de Digital Signage Xibo 1.4.2 permite a atacantes remotos inyectar script Web o HTML arbitrario a través del parámetro layout en la página de disposición. • https://www.exploit-db.com/exploits/38745 http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2013-4887

https://notcve.org/view.php?id=CVE-2013-4887

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter. Vulnerabilidad de inyección de SQL en index.php en Digital Signage Xibo 1.4.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro displayid. • http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html http://www.securityfocus.com/bid/62071 https://exchange.xforce.ibmcloud.com/vulnerabilities/86777 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 2

CVE-2013-4889 – Xibo - Cross-Site Request Forgery

https://notcve.org/view.php?id=CVE-2013-4889

Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888. Múltiples vulnerabilidades de CSRF en index.php de Digital Signage Xibo 1.4.2 permite a atacantes remotos secuestrar la autenticación de administradores por peticiones que (1) añadan un nuevo administrador a través de una acción AddUser o (2) lleven a cabo ataques de XSS, tal y como se demuestra en CVE-2013-4888. • https://www.exploit-db.com/exploits/38746 http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html • CWE-352: Cross-Site Request Forgery (CSRF) •