B3log / Symphony
6 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2024-23049 | An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. | CRITICAL | 9.8 | Feb 5, 2024 |
| CVE-2019-17488 | b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. | MEDIUM | 6.1 | Oct 10, 2019 |
| CVE-2018-16249 | In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payloa… | MEDIUM | 4.8 | Jun 20, 2019 |
| CVE-2019-9142 | An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java. | MEDIUM | 6.1 | Feb 25, 2019 |
| CVE-2018-10469 | b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI. | CRITICAL | 9.8 | Apr 27, 2018 |
| CVE-2017-16821 | b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is… | MEDIUM | 5.4 | Nov 15, 2017 |
Showing 1 to 6 of 6 CVEs