Show filters
28 Total Results
Displaying 11-20 of 28
Sort by:
Attacker Value
Unknown
CVE-2017-5539
Disclosure Date: January 23, 2017 (last updated November 25, 2024)
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
0
Attacker Value
Unknown
CVE-2017-5553
Disclosure Date: January 23, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.
0
Attacker Value
Unknown
CVE-2016-7150
Disclosure Date: January 18, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name.
0
Attacker Value
Unknown
CVE-2016-7149
Disclosure Date: January 18, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function.
0
Attacker Value
Unknown
CVE-2017-5494
Disclosure Date: January 15, 2017 (last updated November 25, 2024)
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
0
Attacker Value
Unknown
CVE-2017-5480
Disclosure Date: January 15, 2017 (last updated November 25, 2024)
Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
0
Attacker Value
Unknown
CVE-2016-9479
Disclosure Date: December 02, 2016 (last updated November 25, 2024)
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
0
Attacker Value
Unknown
CVE-2014-9599
Disclosure Date: January 16, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.
0
Attacker Value
Unknown
CVE-2013-7352
Disclosure Date: April 02, 2014 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-2945.
0
Attacker Value
Unknown
CVE-2013-2945
Disclosure Date: April 02, 2014 (last updated October 05, 2023)
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
0
