Vulnerabilities

TI-2014-04323 CVE-2014-5298 · GHSA-8jfm-3q68-9546

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive…

LOW 28

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03002 Published 2014-10-10 No fix listed CWE-264

TI-2014-04322 CVE-2014-5297 · GHSA-8pcr-qrf2-5hpg

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine…

LOW 38

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafte…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02671 Published 2014-10-10 No fix listed CWE-94

Vulnerabilities

Filters

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive…

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine…