Vulnerabilities

TI-2020-09481 CVE-2020-11807 · GHSA-5gw3-gj8j-f364

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop…

LOW 35

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and sometimes terminal commands) on a server by making an avatar upd…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00652 Published 2020-05-19 No fix listed CWE-434

TI-2013-00615 CVE-2013-0730 · GHSA-w42w-4j45-6535

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admi…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01773 Published 2013-02-22 No fix listed CWE-79

TI-2012-03987 CVE-2012-4679 · GHSA-9pf2-fqfc-vhx2

Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5…

LOW 25

Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the f_user_name parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02354 Published 2012-08-27 No fix listed CWE-79

TI-2012-01712 CVE-2012-1935 · GHSA-qpg6-qgf5-9pr8

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02904 Published 2012-08-27 No fix listed CWE-79

TI-2012-01711 CVE-2012-1934 · GHSA-996c-q543-vq85

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x…

LOW 38

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the f_country_code parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02528 Published 2012-08-27 No fix listed CWE-89

TI-2012-01710 CVE-2012-1933 · GHSA-6pm3-7hqj-9f4c

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4…

LOW 39

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsi…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05633 Published 2012-08-27 No fix listed CWE-94