Filtered by vendor Getsymphony
Subscribe
Search
Total
9 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-8766 | 1 Getsymphony | 1 Symphony | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences. | |||||
| CVE-2020-25343 | 1 Getsymphony | 1 Symphony | 2020-10-14 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php | |||||
| CVE-2017-5542 | 1 Getsymphony | 1 Symphony | 2020-08-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter. | |||||
| CVE-2015-8376 | 1 Getsymphony | 1 Symphony | 2020-08-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Navigation Group, or (3) Label parameter to blueprints/sections/edit/1. | |||||
| CVE-2017-6067 | 1 Getsymphony | 1 Symphony | 2020-08-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. | |||||
| CVE-2017-5541 | 1 Getsymphony | 1 Symphony | 2020-08-25 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters. | |||||
| CVE-2020-15071 | 1 Getsymphony | 1 Symphony | 2020-08-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading. | |||||
| CVE-2017-8876 | 1 Getsymphony | 1 Symphony | 2020-05-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php. | |||||
| CVE-2018-12043 | 1 Getsymphony | 1 Symphony | 2018-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page. | |||||