Vulnerabilities > S9Y > Serendipity > 1.1.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-03-25 | CVE-2020-10964 | Unrestricted Upload of File with Dangerous Type vulnerability in S9Y Serendipity Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. | 9.8 |
| 2019-11-26 | CVE-2011-4090 | Cross-site Scripting vulnerability in S9Y Serendipity Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. | 6.1 |
| 2019-11-05 | CVE-2011-1135 | Cross-site Scripting vulnerability in S9Y Serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php. | 6.1 |
| 2019-11-05 | CVE-2011-1134 | Unrestricted Upload of File with Dangerous Type vulnerability in S9Y Serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. | 9.8 |
| 2019-11-05 | CVE-2011-1133 | Cross-site Scripting vulnerability in S9Y Serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php. | 6.1 |
| 2019-05-09 | CVE-2019-11870 | Cross-site Scripting vulnerability in S9Y Serendipity Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature. | 6.1 |
| 2017-01-14 | CVE-2017-5476 | Cross-Site Request Forgery (CSRF) vulnerability in S9Y Serendipity Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. | 8.8 |
| 2017-01-14 | CVE-2017-5475 | Cross-Site Request Forgery (CSRF) vulnerability in S9Y Serendipity comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. | 8.8 |
| 2017-01-14 | CVE-2017-5474 | Open Redirect vulnerability in S9Y Serendipity Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header. | 6.1 |
| 2016-12-30 | CVE-2016-10082 | Improper Access Control vulnerability in S9Y Serendipity include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file. | 9.8 |