Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)
Recommended action: Upgrade to 9.5.60602 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
Recommended action: Upgrade to 9.5.60437 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 9.0.57473 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability has been found in Tribal Systems Zenario CMS prior to version 8.5.51340. Affected by this issue is some unknown functionality of the file adminorganizer.js of the component Error Log Module. The manipulation leads to cross site scripting. The attack may be launched remotely. The issue is patched in version 8.5.51340.
Recommended action: Upgrade to 8.5.51340 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module.
Recommended action: Upgrade to 8.8.53370 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.
Recommended action: Upgrade to 9.0.55143 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Recommended action: Upgrade to 9.0.55143 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
Recommended action: Upgrade to 9.2.55826 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection in the "adminboxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
Recommended action: Upgrade to 8.8.53370 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reflected XSS in the "adminboxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting into the "cID" parameter when creating a new HTML component.
Recommended action: Upgrade to 8.8.53370 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.