Recently modified vulnerabilities for "piwigo" 2014-11-20

Where

AND

Sort:

piwigo LexiglotInfoleak

Risk 27

Severity

5.3

Infoleak

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.

First published (updated )

CVE-2014-8940

piwigo LexiglotPath Traversal

Risk 27

Severity

5.3

Path Traversal

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.dateformat.php request if PHP has a non-recommended configuration that produces warning messages.

First published (updated )

CVE-2014-8939

piwigo LexiglotLexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update oper…

Risk 43

Severity

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.

First published (updated )

CVE-2014-8937

piwigo LexiglotSQL Injection

Risk 86

Severity

9.8

SQL Injection

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI.

First published (updated )

CVE-2014-8941

piwigo LexiglotOS Command Injection, Command Injection

Risk 86

Severity

9.8

OS Command Injection, Command Injection

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.

First published (updated )

CVE-2014-8945

piwigo LexiglotLexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process …

Risk 69

Severity

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.

First published (updated )

CVE-2014-8938

piwigo LexiglotCSRF

Risk 77

Severity

8.8

CSRF

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Lexiglot through 2014-11-20 allows CSRF.

First published (updated )

CVE-2014-8942

piwigo LexiglotSSRF

Risk 79

Severity

8.8

SSRF

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter.

First published (updated )

CVE-2014-8943

piwigo LexiglotXSS

Risk 34

Severity

5.4

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config installname, intromessage, or newfilecontent parameter.

First published (updated )

CVE-2014-8944

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

Company

Resources

Contact