ALT-PU-2017-1747-1
Closed vulnerabilities
BDU:2015-12236
Уязвимости операционной системы Debian GNU/Linux, позволяющие нарушителю внедрить произвольные SMTP-команды
BDU:2021-03200
Уязвимость компонента app/admin/custom-fields/edit.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-запросы
BDU:2021-03201
Уязвимость компонента app/admin/custom-fields/filter-result.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-запросы
BDU:2021-03202
Уязвимость компонента app/admin/custom-fields/order.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-запросы
BDU:2021-03203
Уязвимость компонента app/admin/custom-fields/edit-result.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-запросы
BDU:2021-03204
Уязвимость компонента app/admin/custom-fields/filter.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-запросы
BDU:2023-01781
Уязвимость сценария app/admin/custom-fields/edit-result.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-команды
Modified: 2024-11-21
CVE-2015-8476
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
- FEDORA-2015-abf9659276
- FEDORA-2015-abf9659276
- FEDORA-2015-39522bb8c9
- FEDORA-2015-39522bb8c9
- DSA-3416
- DSA-3416
- [oss-security] 20151204 CVE Request: PHPMailer Message Injection Vulnerability
- [oss-security] 20151204 CVE Request: PHPMailer Message Injection Vulnerability
- [oss-security] 20151204 Re: CVE Request: PHPMailer Message Injection Vulnerability
- [oss-security] 20151204 Re: CVE Request: PHPMailer Message Injection Vulnerability
- 78619
- 78619
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
Modified: 2024-11-21
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]
- 95108
- 95108
- 1037533
- 1037533
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://www.drupal.org/psa-2016-004
- https://www.drupal.org/psa-2016-004
- 40968
- 40968
- 40969
- 40969
- 40970
- 40970
- 40974
- 40974
- 40986
- 40986
- 41962
- 41962
- 41996
- 41996
- 42024
- 42024
- 42221
- 42221
Modified: 2024-11-21
CVE-2016-10045
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
- [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]
- [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)
- 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)
- 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)
- 95130
- 95130
- 1037533
- 1037533
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- 40969
- 40969
- 40986
- 40986
- 42221
- 42221
Modified: 2024-11-21
CVE-2017-15640
app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.
Modified: 2024-11-21
CVE-2017-5223
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.
- http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/
- http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/
- 95328
- 95328
- https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
- https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
- 43056
- 43056
Modified: 2024-11-21
CVE-2018-1000860
phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'>quqtl exploits an XSS vulnerability. that can result in Arbitrary code executes in victims browser.. This attack appear to be exploitable via Needs to be chained with another exploit that allows an attacker to set or modify a cookie for the phpIPAM instance's domain..
Modified: 2024-11-21
CVE-2018-1000870
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in admin-panel and gets exploited.. This vulnerability appears to have been fixed in 1.4.
Modified: 2024-11-21
CVE-2019-1000010
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
Modified: 2024-11-21
CVE-2019-16692
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
Modified: 2024-11-21
CVE-2019-16693
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
Modified: 2024-11-21
CVE-2019-16694
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
Modified: 2024-11-21
CVE-2019-16695
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
Modified: 2024-11-21
CVE-2019-16696
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
Modified: 2024-11-21
CVE-2022-1223
Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
Modified: 2024-11-21
CVE-2022-1224
Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
Modified: 2024-11-21
CVE-2022-1225
Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.
Modified: 2024-11-21
CVE-2022-3845
A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.
- https://github.com/phpipam/phpipam/commit/22c797c3583001211fe7d31bccd3f1d4aeeb3bbc
- https://github.com/phpipam/phpipam/commit/22c797c3583001211fe7d31bccd3f1d4aeeb3bbc
- https://github.com/phpipam/phpipam/releases/tag/v1.5.0
- https://github.com/phpipam/phpipam/releases/tag/v1.5.0
- https://vuldb.com/?id.212863
- https://vuldb.com/?id.212863
Modified: 2024-11-21
CVE-2023-0676
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
Modified: 2024-11-21
CVE-2023-0677
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
Modified: 2024-11-21
CVE-2023-0678
Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
Modified: 2024-11-21
CVE-2023-1211
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
Modified: 2024-11-21
CVE-2023-1212
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.