CVE-2010-0988
Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote…
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to arbitrary files and execute arbitrary PHP code via vectors involving the (2) filename and (3) block parameters to view.php.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- pulsecms/pulse cms
- Source
- PSIRT-CNA@flexerasoftware.com
References
- http://secunia.com/advisories/39011Vendor Advisory
- http://secunia.com/secunia_research/2010-45/Vendor Advisory
- http://secunia.com/secunia_research/2010-51/Vendor Advisory
- http://www.osvdb.org/63166
- http://www.osvdb.org/63168
- http://www.securityfocus.com/archive/1/510299/100/0/threaded
- http://www.securityfocus.com/archive/1/510300/100/0/threaded
- http://www.securityfocus.com/bid/38956
- http://secunia.com/advisories/39011Vendor Advisory
- http://secunia.com/secunia_research/2010-45/Vendor Advisory
- http://secunia.com/secunia_research/2010-51/Vendor Advisory
- http://www.osvdb.org/63166
- http://www.osvdb.org/63168
- http://www.securityfocus.com/archive/1/510299/100/0/threaded
- http://www.securityfocus.com/archive/1/510300/100/0/threaded
- http://www.securityfocus.com/bid/38956
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.