RSS   Podatności dla 'Domainmod'   RSS

2021-08-12
 
CVE-2020-20988

CWE-79
 
 
A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.

 
 
CVE-2020-20989

CWE-352
 
 
A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.

 
 
CVE-2020-20990

CWE-79
 
 
A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.

 
2021-03-15
 
CVE-2020-35358

CWE-613
 
 
DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.

 
2020-05-08
 
CVE-2020-12735

CWE-331
 
 
reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.

 
2019-08-29
 
CVE-2019-15811

CWE-79
 
 
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.

 
2019-07-18
 
CVE-2019-1010096

CWE-352
 
 
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.

 
 
CVE-2019-1010095

CWE-352
 
 
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: http://127.0.0.1/admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.

 
 
CVE-2019-1010094

CWE-352
 
 
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.

 
2018-12-10
 
CVE-2018-20011

CWE-79
 
 
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.

 

Copyright 2024, cxsecurity.com

 

Back to Top