CVE

Id
55574  
CVE No.
CVE-2012-2331  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).  
Phase
Assigned (20120419)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
579818 55574 CVE-2012-2331 BUGTRAQ:20120508 Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability  View
579819 55574 CVE-2012-2331 URL:http://archives.neohapsis.com/archives/bugtraq/2012-05/0037.html  View
579820 55574 CVE-2012-2331 MLIST:[oss-security] 20120508 CVE request: XSS and SQL injection in serendipity before 1.7.1  View
579821 55574 CVE-2012-2331 URL:http://www.openwall.com/lists/oss-security/2012/05/08/6  View
579822 55574 CVE-2012-2331 MLIST:[oss-security] 20120508 Re: CVE request: XSS and SQL injection in serendipity before 1.7.1  View
579823 55574 CVE-2012-2331 URL:http://www.openwall.com/lists/oss-security/2012/05/09/2  View
579824 55574 CVE-2012-2331 MISC:http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt  View
579825 55574 CVE-2012-2331 MISC:http://www.rul3z.de/index.php?/214-KORAMISADV2012-001-Serendipity-1.6-Backend-Cross-Site-Scripting-and-SQL-Injection-vulnerability.html  View
579826 55574 CVE-2012-2331 CONFIRM:http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html  View
579827 55574 CVE-2012-2331 CONFIRM:https://github.com/s9y/Serendipity/commit/264bf55719baacc069ff9d3cc35f0c349cde11e3  View
579828 55574 CVE-2012-2331 BID:53418  View
579829 55574 CVE-2012-2331 URL:http://www.securityfocus.com/bid/53418  View
579830 55574 CVE-2012-2331 SECUNIA:49009  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
26688 JVNDB-2012-002395 PHP の sapi/cgi/cgi_main.c におけるサービス運用妨害 (リソース消費) の脆弱性 PHP の sapi/cgi/cgi_main.c は、CGI スクリプトとして設定される際、= (等号) 文字を欠いたクエリ文字列を適切に処理しないため、サービス運用妨害 (リソース消費) 状態となる脆弱性が存在します。 CVE-2012-2336 55574 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002395.html  View