PatchTheCVEeasynews vulnerabilities and fixes
Recent CVEs affecting easynews, with upgrade or downgrade steps. 11 tracked.
easynews has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2008-04-02. Highest priority: CVE-2006-6866 (score 54/100).
- CVE-2008-1651 HIGH 7.5 DOWNGRADE Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and ex
- CVE-2008-1650 HIGH 7.5 DOWNGRADE SQL injection vulnerability in dynamicpages/index.php in EasyNews 4.0 allows remote attackers to execute arbit
- CVE-2008-1649 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in staticpages/easypublish/index.php in EasyNews 4.0 allows remote at
- CVE-2007-3331 MEDIUM 5.0 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change th
- CVE-2007-3330 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to inject arbitrary
- CVE-2006-6866 HIGH 7.8 DOWNGRADE STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which
- CVE-2006-5412 MEDIUM 5.1 UPGRADE admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attacker
- CVE-2001-1527 LOW 2.1 DOWNGRADE easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local user
- CVE-2001-1526 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allow
- CVE-2001-1525 MEDIUM 5.0 DOWNGRADE Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers t
- CVE-2001-1437 HIGH 7.5 UPGRADE easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request wi
FAQ
How do I fix easynews vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is easynews being exploited right now?
None of the tracked easynews CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which easynews CVE should I patch first?
CVE-2006-6866 currently ranks highest (54/100): STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which.