8 results (0.010 seconds)

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 2

CVE-2012-4385 – letodms 3.3.6 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2012-4385

letodms 3.3.6 has CSRF via change password letodms versión 3.3.6, tiene una vulnerabilidad de tipo CSRF mediante el cambio de contraseña. • https://www.exploit-db.com/exploits/20759 http://www.openwall.com/lists/oss-security/2012/08/31/19 https://security-tracker.debian.org/tracker/CVE-2012-4385 https://vulmon.com/exploitdetails?qidtp=EDB&qid=20759 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2

CVE-2012-4384 – letodms 3.3.6 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2012-4384

letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar letodms tiene múltiples problemas de tipo XSS: XSS Reflejado en la Página Login, XSS Almacenado en el nombre Document Owner/User, XSS Almacenado en el Calendario. • https://www.exploit-db.com/exploits/20759 http://www.openwall.com/lists/oss-security/2012/08/31/19 https://security-tracker.debian.org/tracker/CVE-2012-4384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2012-4567

https://notcve.org/view.php?id=CVE-2012-4567

Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) inc/inc.ClassUI.php or (2) out/out.DocumentNotify.php. Múltiples vulnerabilidades Cross-Site Scripting (XSS) en LetoDMS (antes MyDMS) en versiones anteriores a la 3.3.8 permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante parámetros no especificados en (1) inc/inc.ClassUI.php o (2) out/out.DocumentNotify.php. • http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG http://www.openwall.com/lists/oss-security/2012/10/06/1 http://www.openwall.com/lists/oss-security/2012/10/31/7 http://www.securityfocus.com/bid/55822 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2012-4568

https://notcve.org/view.php?id=CVE-2012-4568

Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades Cross-Site Request Forgery (CSRF) en LetoDMS (antes MyDMS) en versiones anteriores a la 3.3.8 permiten que atacantes remotos secuestren la autenticación de víctimas no especificadas mediante vectores no conocidos. • http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG http://www.openwall.com/lists/oss-security/2012/10/06/1 http://www.openwall.com/lists/oss-security/2012/10/31/7 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2012-4569

https://notcve.org/view.php?id=CVE-2012-4569

Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades Cross-Site Scripting (XSS) en out/out.UsrMgr.php en LetoDMS (antes MyDMS) en versiones anteriores a la 3.3.9 permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante vectores no especificados. • http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG http://www.openwall.com/lists/oss-security/2012/10/06/1 http://www.openwall.com/lists/oss-security/2012/10/31/7 http://www.securityfocus.com/bid/55823 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •