Search criteria

22 vulnerabilities found for chyrp by chyrp

FKIE_CVE-2024-58285

Vulnerability from fkie_nvd - Published: 2025-12-10 22:16 - Updated: 2025-12-19 17:40
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
References
disclosure@vulncheck.comhttps://github.com/chyrp/Product
disclosure@vulncheck.comhttps://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zipRelease Notes
disclosure@vulncheck.comhttps://www.exploit-db.com/exploits/52013Exploit, Third Party Advisory
disclosure@vulncheck.comhttps://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-titleThird Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.exploit-db.com/exploits/52013Exploit, Third Party Advisory
Impacted products
Vendor Product Version
chyrp chyrp 2.5.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BE8C320-F243-405C-812F-4F9850EDCACD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks."
    }
  ],
  "id": "CVE-2024-58285",
  "lastModified": "2025-12-19T17:40:59.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-10T22:16:20.567",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/chyrp/"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.exploit-db.com/exploits/52013"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-title"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.exploit-db.com/exploits/52013"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2012-1001

Vulnerability from fkie_nvd - Published: 2019-11-21 22:15 - Updated: 2024-11-21 01:36
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
cve@mitre.orghttp://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
cve@mitre.orghttp://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
cve@mitre.orghttps://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
cve@mitre.orghttps://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
af854a3a-2127-422b-91ae-364da2661108http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory
Impacted products
Vendor Product Version
chyrp chyrp *
chyrp chyrp 2.5.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5C993CD-2350-4F59-892B-ED509F869C04",
              "versionEndExcluding": "2.1.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.5.2:b1:*:*:*:*:*:*",
              "matchCriteriaId": "CBA20B10-CB35-465E-8672-91B4DDA5FA7B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en Chyrp versiones anteriores a 2.1.2 y versiones anteriores a 2.5 Beta 2, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio del (1) par\u00e1metro content en el archivo includes/ajax.php o (2) par\u00e1metro body en el archivo includes/error.php."
    }
  ],
  "id": "CVE-2012-1001",
  "lastModified": "2024-11-21T01:36:10.170",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-21T22:15:15.207",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/52115"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/52117"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.htbridge.ch/advisory/HTB23073"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/52115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/52117"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.htbridge.ch/advisory/HTB23073"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2014-7264

Vulnerability from fkie_nvd - Published: 2014-12-11 23:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
References
vultures@jpcert.or.jphttp://chyrp.net/2014/11/18/chyrp-251-security-release/Vendor Advisory
vultures@jpcert.or.jphttp://jvn.jp/en/jp/JVN13160869/index.htmlVendor Advisory
vultures@jpcert.or.jphttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000149Vendor Advisory
vultures@jpcert.or.jphttps://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebbVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://chyrp.net/2014/11/18/chyrp-251-security-release/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://jvn.jp/en/jp/JVN13160869/index.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebbVendor Advisory
Impacted products
Vendor Product Version
chyrp chyrp *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "652DFCF3-D234-41A7-9280-7C52FC22655E",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de XSS en admin/themes/default/pages/manage_users.twig en la caracter\u00edstica Users Management en el componente admin, en Chyrp anterior a 2.5.1, permiten a usuarios remotos autenticados, inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del campo (1) user.email o (2) user.website en admin/robots.php duranet el registro de usuario."
    }
  ],
  "id": "CVE-2014-7264",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-12-11T23:59:01.437",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2011-2745

Vulnerability from fkie_nvd - Published: 2011-07-27 02:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
References
cve@mitre.orghttp://securityreason.com/securityalert/8314
cve@mitre.orghttp://www.justanotherhacker.com/advisories/JAHx113.txtExploit
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/5
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/48672Exploit
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8314
af854a3a-2127-422b-91ae-364da2661108http://www.justanotherhacker.com/advisories/JAHx113.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/5
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48672Exploit
Impacted products
Vendor Product Version
chyrp chyrp *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D1ED6F2-9739-4324-A614-B4F11B88B231",
              "versionEndIncluding": "2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/."
    },
    {
      "lang": "es",
      "value": "upload_handler.php en la extensi\u00f3n swfupload en Chyrp 2.0 y versiones anteriores se basa en el c\u00f3digo JavaScript cliente para restringir las extensiones de archivo de los archivos cargados, lo que permite a usuarios remotos autenticados a cargar un archivo .php, y por lo tanto ejecutar c\u00f3digo PHP arbitrario, a trav\u00e9s de una acci\u00f3n write_post a la URI por defecto en admin/."
    }
  ],
  "id": "CVE-2011-2745",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-07-27T02:55:02.477",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8314"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8314"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2011-2743

Vulnerability from fkie_nvd - Published: 2011-07-19 21:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
References
cve@mitre.orghttp://osvdb.org/73887
cve@mitre.orghttp://osvdb.org/73888
cve@mitre.orghttp://osvdb.org/73889
cve@mitre.orghttp://secunia.com/advisories/45184Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/8312
cve@mitre.orghttp://www.justanotherhacker.com/advisories/JAHx113.txtExploit
cve@mitre.orghttp://www.ocert.org/advisories/ocert-2011-001.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/518890/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/48672Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/68563
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/73887
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/73888
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/73889
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45184Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8312
af854a3a-2127-422b-91ae-364da2661108http://www.justanotherhacker.com/advisories/JAHx113.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.ocert.org/advisories/ocert-2011-001.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/518890/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48672Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/68563
Impacted products
Vendor Product Version
chyrp chyrp *
chyrp chyrp 2.0
chyrp chyrp 2.1
chyrp chyrp 2.1
chyrp chyrp 2.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E12A398-5363-4270-95FB-D63F2A48E42B",
              "versionEndIncluding": "2.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "98801229-48D2-4E7C-A265-D9C491A4E3D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "A971C020-10BE-4104-BAA1-7F2AA3ADC67C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "BCB4ADC9-A75F-4C0F-AC8A-151457DA8DC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:rc:*:*:*:*:*:*",
              "matchCriteriaId": "9B551CE4-0EE0-4C38-99FC-971EDE95E25E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples cross-site scripting (XSS) en Chyrp v2.1 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro de acci\u00f3n: (1) la URI por defecto o (2) includes / javascript.php, o (3) el t\u00edtulo o (4) par\u00e1metros de cuerpo a admin / help.php."
    }
  ],
  "id": "CVE-2011-2743",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-07-19T21:55:00.743",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/73887"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/73888"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/73889"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/73887"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/73888"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/73889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2011-2780

Vulnerability from fkie_nvd - Published: 2011-07-19 21:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
References
cve@mitre.orghttp://osvdb.org/73891
cve@mitre.orghttp://secunia.com/advisories/45184Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/8312
cve@mitre.orghttp://www.justanotherhacker.com/advisories/JAHx113.txtExploit
cve@mitre.orghttp://www.ocert.org/advisories/ocert-2011-001.html
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/5Exploit
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/518890/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/48672Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/68565
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/73891
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45184Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8312
af854a3a-2127-422b-91ae-364da2661108http://www.justanotherhacker.com/advisories/JAHx113.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.ocert.org/advisories/ocert-2011-001.html
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/5Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/518890/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48672Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/68565
Impacted products
Vendor Product Version
chyrp chyrp *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D1ED6F2-9739-4324-A614-B4F11B88B231",
              "versionEndIncluding": "2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de directorio transversal en includes / lib / gz.php en Chyrp v2.0 y anteriores permite a atacantes remotos leer ficheros arbitrarios mediante un .. (punto punto) en el par\u00e1metro de archivo, una vulnerabilidad diferente a CVE-2011-2744."
    }
  ],
  "id": "CVE-2011-2780",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-07-19T21:55:00.837",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/73891"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/73891"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2011-2744

Vulnerability from fkie_nvd - Published: 2011-07-19 20:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
References
cve@mitre.orghttp://osvdb.org/73890
cve@mitre.orghttp://secunia.com/advisories/45184Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/8312
cve@mitre.orghttp://www.justanotherhacker.com/advisories/JAHx113.txtExploit
cve@mitre.orghttp://www.ocert.org/advisories/ocert-2011-001.html
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/5Exploit
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/518890/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/48672Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/68564
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/73890
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45184Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8312
af854a3a-2127-422b-91ae-364da2661108http://www.justanotherhacker.com/advisories/JAHx113.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.ocert.org/advisories/ocert-2011-001.html
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/5Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/13/6Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/518890/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48672Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/68564
Impacted products
Vendor Product Version
chyrp chyrp *
chyrp chyrp 2.0
chyrp chyrp 2.1
chyrp chyrp 2.1
chyrp chyrp 2.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E12A398-5363-4270-95FB-D63F2A48E42B",
              "versionEndIncluding": "2.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "98801229-48D2-4E7C-A265-D9C491A4E3D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "A971C020-10BE-4104-BAA1-7F2AA3ADC67C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "BCB4ADC9-A75F-4C0F-AC8A-151457DA8DC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:chyrp:chyrp:2.1:rc:*:*:*:*:*:*",
              "matchCriteriaId": "9B551CE4-0EE0-4C38-99FC-971EDE95E25E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en Chyrp 2.1 y versiones anteriores. Permite a atancates remotos incluir y ejecutar archivos locales arbitrarios a trav\u00e9s de ..%2F (punto punto barra, o slash, codificados) en el par\u00e1metro action de la URI por defecto."
    }
  ],
  "id": "CVE-2011-2744",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-07-19T20:55:01.257",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/73890"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/73890"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45184"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8312"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/48672"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-58285 (GCVE-0-2024-58285)

Vulnerability from cvelistv5 – Published: 2025-12-10 21:15 – Updated: 2025-12-11 15:40
VLAI?
Title
Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title
Summary
Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
Severity ?
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
chyrp Chyrp Affected: 2.5.2
Create a notification for this product.
Credits
Ahmet Ümit BAYRAM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-58285",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:40:49.193816Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:40:59.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/52013"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Chyrp",
          "vendor": "chyrp",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ahmet \u00dcmit BAYRAM"
        }
      ],
      "datePublic": "2024-04-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eChyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.\u003c/p\u003e"
            }
          ],
          "value": "Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T21:15:16.334Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-52013",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/52013"
        },
        {
          "name": "Chyrp GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/chyrp/"
        },
        {
          "name": "Chyrp Software Archive",
          "tags": [
            "product"
          ],
          "url": "https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip"
        },
        {
          "name": "VulnCheck Advisory: Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-title"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58285",
    "datePublished": "2025-12-10T21:15:16.334Z",
    "dateReserved": "2025-12-10T14:35:24.455Z",
    "dateUpdated": "2025-12-11T15:40:59.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2012-1001 (GCVE-0-2012-1001)

Vulnerability from cvelistv5 – Published: 2019-11-21 21:54 – Updated: 2024-08-06 18:45
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:26.456Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.htbridge.ch/advisory/HTB23073"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52115"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52117"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-21T21:54:40",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.htbridge.ch/advisory/HTB23073"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/52115"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/52117"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1001",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.htbridge.ch/advisory/HTB23073",
              "refsource": "MISC",
              "url": "https://www.htbridge.ch/advisory/HTB23073"
            },
            {
              "name": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html",
              "refsource": "MISC",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
            },
            {
              "name": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/",
              "refsource": "MISC",
              "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
            },
            {
              "name": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c",
              "refsource": "MISC",
              "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
            },
            {
              "name": "http://www.securityfocus.com/bid/52115",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/52115"
            },
            {
              "name": "http://www.securityfocus.com/bid/52117",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/52117"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1001",
    "datePublished": "2019-11-21T21:54:40",
    "dateReserved": "2012-02-02T00:00:00",
    "dateUpdated": "2024-08-06T18:45:26.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-7264 (GCVE-0-2014-7264)

Vulnerability from cvelistv5 – Published: 2014-12-11 23:00 – Updated: 2024-08-06 12:47
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:47:32.392Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVNDB-2014-000149",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
          },
          {
            "name": "JVN#13160869",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-11T22:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVNDB-2014-000149",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
        },
        {
          "name": "JVN#13160869",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2014-7264",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVNDB-2014-000149",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
            },
            {
              "name": "http://chyrp.net/2014/11/18/chyrp-251-security-release/",
              "refsource": "CONFIRM",
              "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
            },
            {
              "name": "JVN#13160869",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
            },
            {
              "name": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb",
              "refsource": "CONFIRM",
              "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2014-7264",
    "datePublished": "2014-12-11T23:00:00",
    "dateReserved": "2014-09-30T00:00:00",
    "dateUpdated": "2024-08-06T12:47:32.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2745 (GCVE-0-2011-2745)

Vulnerability from cvelistv5 – Published: 2011-07-27 01:29 – Updated: 2024-08-06 23:08
VLAI?
Summary
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:24.091Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8314",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8314"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-09-22T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8314",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8314"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2745",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8314",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8314"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2745",
    "datePublished": "2011-07-27T01:29:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:24.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2780 (GCVE-0-2011-2780)

Vulnerability from cvelistv5 – Published: 2011-07-19 21:00 – Updated: 2024-08-06 23:15
VLAI?
Summary
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:15:31.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "name": "73891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73891"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "chyrp-gz-directory-traversal(68565)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "name": "73891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73891"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "chyrp-gz-directory-traversal(68565)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2780",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "73891",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73891"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "chyrp-gz-directory-traversal(68565)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2780",
    "datePublished": "2011-07-19T21:00:00",
    "dateReserved": "2011-07-19T00:00:00",
    "dateUpdated": "2024-08-06T23:15:31.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2743 (GCVE-0-2011-2743)

Vulnerability from cvelistv5 – Published: 2011-07-19 21:00 – Updated: 2024-08-06 23:08
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/8312 third-party-advisoryx_refsource_SREASON
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.justanotherhacker.com/advisories/JAHx113.txt x_refsource_MISC
http://www.securityfocus.com/bid/48672 vdb-entryx_refsource_BID
http://www.ocert.org/advisories/ocert-2011-001.html x_refsource_MISC
http://osvdb.org/73888 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/518890/100… mailing-listx_refsource_BUGTRAQ
http://osvdb.org/73887 vdb-entryx_refsource_OSVDB
http://osvdb.org/73889 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/45184 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:23.892Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "name": "chyrp-multiple-xss(68563)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "73888",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73888"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "73887",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73887"
          },
          {
            "name": "73889",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73889"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "name": "chyrp-multiple-xss(68563)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "73888",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73888"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "73887",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73887"
        },
        {
          "name": "73889",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73889"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2743",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "chyrp-multiple-xss(68563)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "73888",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73888"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "73887",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73887"
            },
            {
              "name": "73889",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73889"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2743",
    "datePublished": "2011-07-19T21:00:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:23.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2744 (GCVE-0-2011-2744)

Vulnerability from cvelistv5 – Published: 2011-07-19 20:00 – Updated: 2024-08-06 23:08
VLAI?
Summary
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:23.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "chyrp-action-local-file-include(68564)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "73890",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73890"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "chyrp-action-local-file-include(68564)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "73890",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73890"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2744",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "chyrp-action-local-file-include(68564)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "73890",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73890"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2744",
    "datePublished": "2011-07-19T20:00:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:23.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-58285 (GCVE-0-2024-58285)

Vulnerability from nvd – Published: 2025-12-10 21:15 – Updated: 2025-12-11 15:40
VLAI?
Title
Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title
Summary
Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
Severity ?
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
chyrp Chyrp Affected: 2.5.2
Create a notification for this product.
Credits
Ahmet Ümit BAYRAM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-58285",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:40:49.193816Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:40:59.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.exploit-db.com/exploits/52013"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Chyrp",
          "vendor": "chyrp",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ahmet \u00dcmit BAYRAM"
        }
      ],
      "datePublic": "2024-04-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eChyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.\u003c/p\u003e"
            }
          ],
          "value": "Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T21:15:16.334Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-52013",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/52013"
        },
        {
          "name": "Chyrp GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/chyrp/"
        },
        {
          "name": "Chyrp Software Archive",
          "tags": [
            "product"
          ],
          "url": "https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip"
        },
        {
          "name": "VulnCheck Advisory: Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-title"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58285",
    "datePublished": "2025-12-10T21:15:16.334Z",
    "dateReserved": "2025-12-10T14:35:24.455Z",
    "dateUpdated": "2025-12-11T15:40:59.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2012-1001 (GCVE-0-2012-1001)

Vulnerability from nvd – Published: 2019-11-21 21:54 – Updated: 2024-08-06 18:45
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:26.456Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.htbridge.ch/advisory/HTB23073"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52115"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52117"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-21T21:54:40",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.htbridge.ch/advisory/HTB23073"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/52115"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/52117"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1001",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.htbridge.ch/advisory/HTB23073",
              "refsource": "MISC",
              "url": "https://www.htbridge.ch/advisory/HTB23073"
            },
            {
              "name": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html",
              "refsource": "MISC",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html"
            },
            {
              "name": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/",
              "refsource": "MISC",
              "url": "http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/"
            },
            {
              "name": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c",
              "refsource": "MISC",
              "url": "https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c"
            },
            {
              "name": "http://www.securityfocus.com/bid/52115",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/52115"
            },
            {
              "name": "http://www.securityfocus.com/bid/52117",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/52117"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1001",
    "datePublished": "2019-11-21T21:54:40",
    "dateReserved": "2012-02-02T00:00:00",
    "dateUpdated": "2024-08-06T18:45:26.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-7264 (GCVE-0-2014-7264)

Vulnerability from nvd – Published: 2014-12-11 23:00 – Updated: 2024-08-06 12:47
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:47:32.392Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVNDB-2014-000149",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
          },
          {
            "name": "JVN#13160869",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-11T22:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVNDB-2014-000149",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
        },
        {
          "name": "JVN#13160869",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2014-7264",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVNDB-2014-000149",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149"
            },
            {
              "name": "http://chyrp.net/2014/11/18/chyrp-251-security-release/",
              "refsource": "CONFIRM",
              "url": "http://chyrp.net/2014/11/18/chyrp-251-security-release/"
            },
            {
              "name": "JVN#13160869",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN13160869/index.html"
            },
            {
              "name": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb",
              "refsource": "CONFIRM",
              "url": "https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2014-7264",
    "datePublished": "2014-12-11T23:00:00",
    "dateReserved": "2014-09-30T00:00:00",
    "dateUpdated": "2024-08-06T12:47:32.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2745 (GCVE-0-2011-2745)

Vulnerability from nvd – Published: 2011-07-27 01:29 – Updated: 2024-08-06 23:08
VLAI?
Summary
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:24.091Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8314",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8314"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-09-22T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8314",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8314"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2745",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8314",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8314"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2745",
    "datePublished": "2011-07-27T01:29:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:24.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2780 (GCVE-0-2011-2780)

Vulnerability from nvd – Published: 2011-07-19 21:00 – Updated: 2024-08-06 23:15
VLAI?
Summary
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:15:31.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "name": "73891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73891"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "chyrp-gz-directory-traversal(68565)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "name": "73891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73891"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "chyrp-gz-directory-traversal(68565)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2780",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "73891",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73891"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "chyrp-gz-directory-traversal(68565)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68565"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2780",
    "datePublished": "2011-07-19T21:00:00",
    "dateReserved": "2011-07-19T00:00:00",
    "dateUpdated": "2024-08-06T23:15:31.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2743 (GCVE-0-2011-2743)

Vulnerability from nvd – Published: 2011-07-19 21:00 – Updated: 2024-08-06 23:08
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/8312 third-party-advisoryx_refsource_SREASON
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.justanotherhacker.com/advisories/JAHx113.txt x_refsource_MISC
http://www.securityfocus.com/bid/48672 vdb-entryx_refsource_BID
http://www.ocert.org/advisories/ocert-2011-001.html x_refsource_MISC
http://osvdb.org/73888 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/518890/100… mailing-listx_refsource_BUGTRAQ
http://osvdb.org/73887 vdb-entryx_refsource_OSVDB
http://osvdb.org/73889 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/45184 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:23.892Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "name": "chyrp-multiple-xss(68563)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "73888",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73888"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "73887",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73887"
          },
          {
            "name": "73889",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73889"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "name": "chyrp-multiple-xss(68563)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "73888",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73888"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "73887",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73887"
        },
        {
          "name": "73889",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73889"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2743",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "chyrp-multiple-xss(68563)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68563"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "73888",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73888"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "73887",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73887"
            },
            {
              "name": "73889",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73889"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2743",
    "datePublished": "2011-07-19T21:00:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:23.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2744 (GCVE-0-2011-2744)

Vulnerability from nvd – Published: 2011-07-19 20:00 – Updated: 2024-08-06 23:08
VLAI?
Summary
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:08:23.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8312",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8312"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
          },
          {
            "name": "chyrp-action-local-file-include(68564)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
          },
          {
            "name": "48672",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/48672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
          },
          {
            "name": "73890",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/73890"
          },
          {
            "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
          },
          {
            "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
          },
          {
            "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
          },
          {
            "name": "45184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/45184"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8312",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8312"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
        },
        {
          "name": "chyrp-action-local-file-include(68564)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
        },
        {
          "name": "48672",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/48672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
        },
        {
          "name": "73890",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/73890"
        },
        {
          "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
        },
        {
          "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
        },
        {
          "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
        },
        {
          "name": "45184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/45184"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2744",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8312",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8312"
            },
            {
              "name": "http://www.justanotherhacker.com/advisories/JAHx113.txt",
              "refsource": "MISC",
              "url": "http://www.justanotherhacker.com/advisories/JAHx113.txt"
            },
            {
              "name": "chyrp-action-local-file-include(68564)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68564"
            },
            {
              "name": "48672",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/48672"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2011-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2011-001.html"
            },
            {
              "name": "73890",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/73890"
            },
            {
              "name": "20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/518890/100/0/threaded"
            },
            {
              "name": "[oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/6"
            },
            {
              "name": "[oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/07/13/5"
            },
            {
              "name": "45184",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/45184"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2744",
    "datePublished": "2011-07-19T20:00:00",
    "dateReserved": "2011-07-13T00:00:00",
    "dateUpdated": "2024-08-06T23:08:23.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

JVNDB-2014-000149

Vulnerability from jvndb - Published: 2014-12-10 14:18 - Updated:2014-12-15 18:06
Severity ?
N/A (UNKNOWN) - -
Summary
Chyrp vulnerable to cross-site scripting
Details
Chyrp is a blogging engine. Chyrp contains a cross-site scripting vulnerability. Yuji Tounai of NTT Com Security (Japan) KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000149.html",
  "dc:date": "2014-12-15T18:06+09:00",
  "dcterms:issued": "2014-12-10T14:18+09:00",
  "dcterms:modified": "2014-12-15T18:06+09:00",
  "description": "Chyrp is a blogging engine. Chyrp contains a cross-site scripting vulnerability.\r\n\r\nYuji Tounai of NTT Com Security (Japan) KK reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000149.html",
  "sec:cpe": {
    "#text": "cpe:/a:chyrp:chyrp",
    "@product": "Chyrp",
    "@vendor": "Chyrp",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "3.5",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000149",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN13160869/index.html",
      "@id": "JVN#13160869",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7264",
      "@id": "CVE-2014-7264",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7264",
      "@id": "CVE-2014-7264",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Chyrp vulnerable to cross-site scripting"
}