TI-2017-04634 CVE-2017-6908 · GHSA-rfgg-9xf9-95wg
An issue was discovered in concrete5 <= 5.6.3.4.
Priority LOW 30
An issue was discovered in concrete5 <= 5.6.3.4.
Vulnerabilities
9 records
TI-2017-04631 CVE-2017-6905 · GHSA-5v8q-gjmf-rmm4
An issue was discovered in concrete5 <= 5.6.3.4.
Priority LOW 29
An issue was discovered in concrete5 <= 5.6.3.4.
TI-2015-03372 CVE-2015-3989 · GHSA-jxhp-rwqv-9fjj
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow…
Priority LOW 22
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
TI-2015-01997 CVE-2015-2250 · GHSA-4386-3ggv-4ppc
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/…
TI-2014-07748 CVE-2014-9526 · GHSA-qvxc-3hm6-c42q
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/group…
TI-2014-04179 CVE-2014-5108 · GHSA-4269-gch5-8w3c
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.
TI-2014-04178 CVE-2014-5107 · GHSA-m9jx-h2qw-h5qj
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a…
Priority LOW 28
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail…
TI-2012-04370 CVE-2012-5181 · GHSA-x4x9-4c65-73w8
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
TI-2011-03278 CVE-2011-3721 · GHSA-4qpv-jgvp-h49c
concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive…
Priority LOW 26
concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/spellche…