Bitrix
10 CVEs across 6 Bitrix products. Browse Bitrix vulnerabilities, severities, and proof-of-concept exploits.
Bitrix products with known CVEs
Bitrix CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2017-20122 | Low | 3.5 | 2022-06-30 | A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2020-13758 | Medium | 6.1 | 2020-06-01 | modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before… |
CVE-2015-8358 | | | 2015-12-16 | Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local f… |
CVE-2015-8357 | | | 2015-12-16 | Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequen… |
CVE-2013-6788 | | | 2014-05-30 | The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote atta… |
CVE-2006-2479 | | | 2006-05-19 | The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive… |
CVE-2006-2478 | | | 2006-05-19 | Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a HTTP POST request. NOTE: this issue has… |
CVE-2006-2477 | | | 2006-05-19 | Cross-site scripting (XSS) vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitrary web script or HT… |
CVE-2006-2476 | | | 2006-05-19 | Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive in… |
CVE-2005-1996 | | | 2005-06-15 | PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMEN… |
CVE-2005-1995 | | | 2005-06-15 | Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which rev… |