RSS   Podatności dla 'Limesurvey'   RSS

2021-06-28
 
CVE-2020-22607

CWE-79
 

 
Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.

 
 
CVE-2020-23710

CWE-79
 

 
Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.

 
2021-02-14
 
CVE-2019-25019

CWE-89
 

 
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

 
2020-12-31
 
CVE-2020-25799

CWE-79
 

 
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.

 
 
CVE-2020-25797

CWE-79
 

 
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.

 
2020-08-05
 
CVE-2020-16192

CWE-79
 

 
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.

 
2020-04-01
 
CVE-2020-11456

CWE-79
 

 
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).

 
 
CVE-2020-11455

CWE-22
 

 
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

 
2020-03-16
 
CVE-2019-14512

CWE-79
 

 
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.

 
2019-09-09
 
CVE-2019-16187

CWE-200
 

 
Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.

 


Copyright 2021, cxsecurity.com

 

Back to Top