Joomla JV Comment 3.0.2 SQL Injection

Advisory ID: HTB23195 Product: JV Comment Joomla Extension Vendor: joomlavi.com Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: January 2, 2014 without technical details Vendor Notification: January 2, 2014 Vendor Patch: January 14, 2014 Public Disclosure...

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

DEBIAN-CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

Design/Logic Flaw

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used with a specific HardwareAccel setting on Intel Sandy Bridge/Ivy Bridge, may fail to generate random numbers for relay and hidden-service identity keys, potentially bypassing cryptographic protections. Impact is partial confidentiality/integrity risk; ...

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

SQL Injection in doorGets CMS

High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...

Cross-Site Scripting (XSS) in WP-Cron Dashboard Wordpress plugin

Advisory ID: HTB23189 Product: WP-Cron Dashboard Wordpress plugin Vendor: OKAMOTO Wataru Vulnerable Versions: 1.1.5 and probably prior Tested Version: 1.1.5 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin

Advisory ID: HTB23187 Product: Ad-minister Wordpress plugin Vendor: henrikmelin, kalstrom Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin

Advisory ID: HTB23188 Product: AskApache Firefox Adsense Wordpress plugin Vendor: AskApache Vulnerable Versions: 3.0 and probably prior Tested Version: 3.0 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

Path Traversal in eduTrac

Advisory ID: HTB23190 Product: eduTrac Vendor: 7 Media Web Solutions, LLC. Vulnerable Versions: 1.1.1-Stable and probably prior Tested Version: 1.1.1-Stable Advisory Publication: December 11, 2013 without technical details Vendor Notification: December 11, 2013 Vendor Patch: December 16, 2013...

Horizon QCMS 4.0 SQL Injection / Directory Traversal

Advisory ID: HTB23191 Product: Horizon QCMS Vendor: Horizon QCMS Vulnerable Versions: 4.0 and probably prior Tested Version: 4.0 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 25, 2013 Public Disclosure: January 8,...

Multiple SQL Injection Vulnerabilities in AuraCMS

High-Tech Bridge Security Research Lab discovered two SQL injection vulnerabilities in AuraCMS, which can be exploited to alter SQL queries and execute arbitrary SQL commands in application's database. 1 Multiple SQL Injection Vulnerabilities in AuraCMS: CVE-2014-1401 1.1 The vulnerability exists...

eduTrac 1.1.1-Stable Path Traversal Vulnerability

Exploit for php platform in category web applications Product: eduTrac Vendor: 7 Media Web Solutions, LLC. Vulnerable Versions: 1.1.1-Stable and probably prior Tested Version: 1.1.1-Stable Advisory Publication: December 11, 2013 without technical details Vendor Notification: December 11, 2013...

AskApache 3.0 Cross Site Request Forgery Vulnerability

AskApache Firefox Adsense WordPress plugin version 3.0 suffers from a cross site request forgery vulnerability. Product: AskApache Firefox Adsense Wordpress plugin Vendor: AskApache Vulnerable Versions: 3.0 and probably prior Tested Version: 3.0 Advisory Publication: December 5, 2013 without...

WordPress Ad-minister 0.6 Cross Site Scripting Vulnerability

WordPress Ad-minister plugin version 0.6 suffers from a cross site scripting vulnerability. Product: Ad-minister Wordpress plugin Vendor: henrikmelin, kalstrom Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: December 5, 2013 without technical details Vendor...

WordPress WP-Cron 1.1.5 Cross Site Scripting Vulnerability

WordPress WP-Cron Dashboard plugin version 1.1.5 suffers from a cross site scripting vulnerability. Product: WP-Cron Dashboard Wordpress plugin Vendor: OKAMOTO Wataru Vulnerable Versions: 1.1.5 and probably prior Tested Version: 1.1.5 Advisory Publication: December 5, 2013 without technical detai...

WordPress Ad-minister 0.6 Cross Site Scripting

Advisory ID: HTB23187 Product: Ad-minister Wordpress plugin Vendor: henrikmelin, kalstrom Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

WordPress WP-Cron 1.1.5 Cross Site Scripting

Advisory ID: HTB23189 Product: WP-Cron Dashboard Wordpress plugin Vendor: OKAMOTO Wataru Vulnerable Versions: 1.1.5 and probably prior Tested Version: 1.1.5 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...