Show filters
68 Total Results
Displaying 21-30 of 68
Sort by:
Attacker Value
Unknown
CVE-2020-11456
Disclosure Date: April 01, 2020 (last updated February 21, 2025)
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
0
Attacker Value
Unknown
CVE-2020-11455
Disclosure Date: April 01, 2020 (last updated February 21, 2025)
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
0
Attacker Value
Unknown
CVE-2019-14512
Disclosure Date: March 16, 2020 (last updated February 21, 2025)
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
0
Attacker Value
Unknown
CVE-2019-17660
Disclosure Date: October 16, 2019 (last updated November 27, 2024)
A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO.
0
Attacker Value
Unknown
CVE-2019-16185
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
0
Attacker Value
Unknown
CVE-2019-16178
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.
0
Attacker Value
Unknown
CVE-2019-16181
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
0
Attacker Value
Unknown
CVE-2019-16179
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
0
Attacker Value
Unknown
CVE-2019-16176
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.
0
Attacker Value
Unknown
CVE-2019-16187
Disclosure Date: September 09, 2019 (last updated November 27, 2024)
Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.
0
