Show filters
36 Total Results
Displaying 21-30 of 36
Sort by:
Attacker Value
Unknown
CVE-2017-7321
Disclosure Date: March 30, 2017 (last updated November 26, 2024)
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
0
Attacker Value
Unknown
CVE-2017-7322
Disclosure Date: March 30, 2017 (last updated November 26, 2024)
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
0
Attacker Value
Unknown
CVE-2017-7324
Disclosure Date: March 30, 2017 (last updated November 26, 2024)
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.
0
Attacker Value
Unknown
CVE-2017-7320
Disclosure Date: March 30, 2017 (last updated November 26, 2024)
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
0
Attacker Value
Unknown
CVE-2016-10039
Disclosure Date: December 24, 2016 (last updated November 25, 2024)
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.
0
Attacker Value
Unknown
CVE-2016-10037
Disclosure Date: December 24, 2016 (last updated November 25, 2024)
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter, related to browser/directory/getlist.
0
Attacker Value
Unknown
CVE-2016-10038
Disclosure Date: December 24, 2016 (last updated November 25, 2024)
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.
0
Attacker Value
Unknown
CVE-2014-8992
Disclosure Date: December 22, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
0
Attacker Value
Unknown
CVE-2014-8774
Disclosure Date: December 03, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter.
0
Attacker Value
Unknown
CVE-2014-8775
Disclosure Date: December 03, 2014 (last updated October 05, 2023)
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
0
