Known vulnerabilities in SPIP - page 2

Vendor: spip.net
Software: SPIP
Software CPE: cpe:2.3:a:spip_net:spip:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 38
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SPIP SPIP is affected by 38 known vulnerabilities: 1 critical, 9 high, 14 medium, 14 low Critical High Medium Low

Vulnerabilities (38)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU21414 - Improper Authorization
CVE-2019-11071
CWE-285 Medium
No
No
3.1.10, 3.2.4 29.09.2019 SB2019041032
SB2020092421
#VU21413 - Exposure of sensitive information to an unauthorized actor
CVE-2019-16394
CWE-200 Low
No
No
3.1.11, 3.2.5 29.09.2019 SB2019092912
SB2019092913
SB2020092421
#VU21411 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-16392
CWE-79 Low
No
No
3.1.11, 3.2.5 29.09.2019 SB2019092912
SB2019092913
SB2020092421
#VU21410 - Improper Access Control
CVE-2019-16391
CWE-284 Medium
No
No
3.1.11, 3.2.5 29.09.2019 SB2019092912
SB2019092913
SB2020092421
#VU38851 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2017-9736
CWE-78 High
No
No
- 17.06.2017 SB2017061708
#VU2746 - Improper Access Control
CVE-2009-3041
CWE-284 Critical
Available
No
- 22.12.2016 SB2009080601
#VU39970 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-9997
CWE-79 Low
No
No
- 17.12.2016 SB2016120504
#VU39971 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-9998
CWE-79 Low
No
No
- 17.12.2016 SB2016120504
#VU39995 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-9152
CWE-79 Low
No
No
- 05.12.2016 SB2016120504
#VU40406 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-3154
CWE-94 High
No
No
- 08.04.2016 SB2016040812
#VU40407 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-3153
CWE-94 High
No
No
- 08.04.2016 SB2016040813
#VU42095 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-7303
CWE-79 Low
No
No
- 30.01.2014 SB2013111803
#VU42365 - Cross-Site Request Forgery (CSRF)
CVE-2013-4555
CWE-352 Medium
No
No
- 18.11.2013 SB2013111807
#VU42366 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-4556
CWE-79 Low
No
No
- 18.11.2013 SB2013111803
#VU42367 - Improper Control of Generation of Code ('Code Injection')
CVE-2013-4557
CWE-94 Medium
No
No
- 18.11.2013 SB2013111803
#VU42737 - Improper input validation
CVE-2013-2118
CWE-20 Medium
Available
No
- 09.07.2013 SB2013070907
#VU43724 - Improper input validation
CVE-2012-4331
CWE-20 High
No
No
- 15.08.2012 SB2012081511
#VU43727 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-2151
CWE-79 Low
No
No
- 15.08.2012 SB2012081511


Showing elements 21 - 40 out of 38