1. Home

CIVI-SA-2023-08: KCFinder XSS

Published
2023-09-06 12:00
Written by
dev-team

KCFinder provides a file-management dialog for CKEditor 4. It included two vulnerabilities:

  1. It allowed a "reflected" cross-site scripting (XSS) attack.
  2. It bypassed a CiviCRM policy option which limits file-uploads. (This bypass was still subject to other restrictions. The likely impact is to allow a "stored" XSS attack. However, it is possible for there to be other impacts.)

More Greetings - Personalised Strings for all Contacts 1.1.0

Extension
More Greetings - Personalised Strings for all Contacts
Release Date
Release Version
1.1.0
Release Status
Stable
Release CiviCRM Compatibility
CiviCRM 5.0
Download URL (zip)
https://github.com/systopia/de.systopia.moregreetings/releases/download/1.1.0/d…
XML
<?xml version="1.0"?>
<extension key="de.systopia.moregreetings" type="module">
<file>moregreetings</file>
<name>More Greeting Options</name>
<description>Extension to allow additional, customised greetings</description>
<license>AGPL-3.0</license>
<maintainer>
<author>SYSTOPIA</author>
<email>endres@systopia.de</email>
</maintainer>
<urls>
<url desc="Main Extension Page">https://github.com/systopia/de.systopia.moregreetings</url>
<url desc="Documentation">https://github.com/systopia/de.systopia.moregreetings</url>
<url desc="Support">https://github.com/systopia/de.systopia.moregreetings/issues</url>
<url desc="Licensing">http://www.gnu.org/licenses/agpl-3.0.html</url>
</urls>
<releaseDate>2023-02-27</releaseDate>
<version>1.1.0</version>
<develStage>stable</develStage>
<compatibility>
<ver>5.0</ver>
</compatibility>
<comments></comments>
<civix>
<namespace>CRM/Moregreetings</namespace>
</civix>
</extension>
Release notes
https://github.com/systopia/de.systopia.moregreetings/releases/tag/1.1.0

CiviCRM + WordPress + The Island theme

Published
2023-02-23 08:09
Written by
bgm

Recent version of CiviCRM with the The Island theme on WordPress. Minimal read-only demo.

To login: username is "demo" and password is "demo123".

We provide turn-key CiviCRM hosting (no installation costs, regular CiviCRM upgrades, backups, secure https, 24/7 monitoring, no lock-in) with Drupal7, Drupal8 and WordPress, in French, English or bilingual configurations.

Subscribe to