S9Y » Serendipity : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2019-11870	79	XSS	2019-05-09	2019-05-10	4.3	None	Remote	Medium	Not required	None	Partial	None
Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
2	CVE-2017-1000129	89	Sql	2017-11-17	2017-11-29	5.0	None	Remote	Low	Not required	Partial	None	None
Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure
3	CVE-2017-8102	79	XSS	2017-04-24	2017-04-28	3.5	None	Remote	Medium	???	None	Partial	None
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
4	CVE-2017-8101	352	CSRF	2017-04-24	2017-04-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.
5	CVE-2017-5609	89	Exec Code Sql	2017-01-28	2019-03-19	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
6	CVE-2017-5476	352	CSRF	2017-01-14	2017-01-25	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.
7	CVE-2017-5475	352	CSRF	2017-01-14	2017-01-25	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.
8	CVE-2017-5474	601		2017-01-14	2017-01-25	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
9	CVE-2016-10752	434	Exec Code	2019-05-24	2019-05-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
10	CVE-2016-10737	79	XSS	2019-01-16	2019-01-23	3.5	None	Remote	Medium	???	None	Partial	None
Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.
11	CVE-2016-10082	284	Exec Code File Inclusion	2016-12-30	2017-01-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file.
12	CVE-2016-9752	918	Bypass	2016-12-01	2016-12-03	5.0	None	Remote	Low	Not required	None	Partial	None
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
13	CVE-2016-9681	79	XSS	2016-12-25	2016-12-30	3.5	None	Remote	Medium	???	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.
14	CVE-2015-8603	79	XSS	2016-01-12	2018-10-09	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.
15	CVE-2015-6969	79	XSS	2015-09-16	2015-09-16	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.
16	CVE-2015-6968		Exec Code	2015-09-16	2015-09-16	6.5	None	Remote	Low	???	Partial	Partial	Partial
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
17	CVE-2015-6943	89	Exec Code Sql	2015-09-15	2016-12-22	6.0	None	Remote	Medium	???	Partial	Partial	Partial
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
18	CVE-2015-2289	79	XSS	2015-03-23	2018-10-09	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
19	CVE-2014-9432	79	XSS	2014-12-31	2018-10-09	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.
20	CVE-2013-5670	79	XSS	2013-11-05	2013-11-07	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.
21	CVE-2013-5314	79	XSS	2013-08-19	2013-08-20	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.
22	CVE-2012-2762	89	Exec Code Sql	2012-06-07	2017-08-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
23	CVE-2012-2332	89	Exec Code Sql CSRF	2012-08-13	2012-08-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
24	CVE-2012-2331	79	XSS CSRF	2012-08-13	2012-08-14	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
25	CVE-2011-4090	79	XSS	2019-11-26	2019-12-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
26	CVE-2011-3800	200	+Info	2011-09-24	2012-05-21	5.0	None	Remote	Low	Not required	Partial	None	None
Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.
27	CVE-2011-1135	79	Exec Code XSS	2019-11-05	2019-11-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
28	CVE-2011-1134	434	Exec Code XSS	2019-11-05	2019-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
29	CVE-2011-1133	79	Exec Code XSS	2019-11-05	2019-11-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
30	CVE-2010-2957	79	XSS	2010-09-10	2010-09-10	2.6	None	Remote	High	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
31	CVE-2009-4412		Exec Code	2009-12-24	2017-08-17	6.0	None	Remote	Medium	???	Partial	Partial	Partial
Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information.
32	CVE-2008-1386	79	XSS	2008-04-23	2018-10-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited.
33	CVE-2008-1385	79	XSS	2008-04-23	2018-10-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
34	CVE-2008-0124	79	XSS	2008-02-28	2017-08-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.
35	CVE-2007-6205	79	XSS	2007-12-11	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the remote RSS sidebar plugin (serendipity_plugin_remoterss) in S9Y Serendipity before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via a link in an RSS feed.
36	CVE-2006-6242	22	Dir. Trav.	2006-12-03	2017-10-19	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. (dot dot) sequence in the serendipity[charset] parameter in (1) include/lang.inc.php; or to plugins/ scripts (2) serendipity_event_bbcode/serendipity_event_bbcode.php, (3) serendipity_event_browsercompatibility/serendipity_event_browsercompatibility.php, (4) serendipity_event_contentrewrite/serendipity_event_contentrewrite.php, (5) serendipity_event_creativecommons/serendipity_event_creativecommons.php, (6) serendipity_event_emoticate/serendipity_event_emoticate.php, (7) serendipity_event_entryproperties/serendipity_event_entryproperties.php, (8) serendipity_event_karma/serendipity_event_karma.php, (9) serendipity_event_livesearch/serendipity_event_livesearch.php, (10) serendipity_event_mailer/serendipity_event_mailer.php, (11) serendipity_event_nl2br/serendipity_event_nl2br.php, (12) serendipity_event_s9ymarkup/serendipity_event_s9ymarkup.php, (13) serendipity_event_searchhighlight/serendipity_event_searchhighlight.php, (14) serendipity_event_spamblock/serendipity_event_spamblock.php, (15) serendipity_event_spartacus/serendipity_event_spartacus.php, (16) serendipity_event_statistics/serendipity_plugin_statistics.php, (17) serendipity_event_templatechooser/serendipity_event_templatechooser.php, (18) serendipity_event_textile/serendipity_event_textile.php, (19) serendipity_event_textwiki/serendipity_event_textwiki.php, (20) serendipity_event_trackexits/serendipity_event_trackexits.php, (21) serendipity_event_weblogping/serendipity_event_weblogping.php, (22) serendipity_event_xhtmlcleanup/serendipity_event_xhtmlcleanup.php, (23) serendipity_plugin_comments/serendipity_plugin_comments.php, (24) serendipity_plugin_creativecommons/serendipity_plugin_creativecommons.php, (25) serendipity_plugin_entrylinks/serendipity_plugin_entrylinks.php, (26) serendipity_plugin_eventwrapper/serendipity_plugin_eventwrapper.php, (27) serendipity_plugin_history/serendipity_plugin_history.php, (28) serendipity_plugin_recententries/serendipity_plugin_recententries.php, (29) serendipity_plugin_remoterss/serendipity_plugin_remoterss.php, (30) serendipity_plugin_shoutbox/serendipity_plugin_shoutbox.php, and and (31) serendipity_plugin_templatedropdown/serendipity_plugin_templatedropdown.php.
37	CVE-2006-2495		CSRF	2006-05-20	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag.
38	CVE-2006-1910		Exec Code	2006-04-20	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
39	CVE-2005-3129		CSRF	2005-10-04	2017-07-11	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag to serendipity_admin.php.
40	CVE-2005-1713		XSS	2005-05-24	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) templatedropdown and (2) shoutbox plugins.
41	CVE-2005-1452			2005-05-03	2008-09-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Serendipity before 0.8 allows Chief users to "hide plugins installed by other users."
42	CVE-2005-1451			2005-05-03	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files.
43	CVE-2005-1450			2005-05-03	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unknown vulnerability in "the function used to validate path-names for uploading media" in Serendipity before 0.8 has unknown impact.
44	CVE-2005-1449			2005-05-03	2008-09-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unknown vulnerability in serendipity_config_local.inc.php for Serendipity before 0.8 has unknown impact.
45	CVE-2005-1448		XSS	2005-05-03	2008-09-05	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site scripting (XSS) vulnerability in the BBCode plugin for Serendipity before 0.8 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
46	CVE-2005-1134		Exec Code Sql	2005-04-13	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) entry_id parameters.
47	CVE-2004-2525		XSS	2004-12-31	2017-07-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the searchTerm variable.
48	CVE-2004-2158		Exec Code Sql	2004-12-31	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
49	CVE-2004-2157		XSS	2004-12-31	2017-07-11	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
50	CVE-2004-1620		Http R.Spl.	2004-10-21	2017-07-11	5.0	None	Remote	Low	Not required	None	Partial	None
CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.

Total number of vulnerabilities : 50 Page : 1 (This Page)