Cross-site Scripting (XSS) Vulnerabilities in Gollos

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Gollos which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Gollos 1.1 The vulnerability exists due to input sanitation errors in the "returnurl" paramet...

SQL Injection Vulnerabilities in Seo Panel

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Seo Panel which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerabilities in Seo Panel 1.1 The vulnerability exists due to input sanitation errors in the "langcode" parameter in...

Multiple Vulnerabilities in ViArt Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ViArt Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerability in ViArt Shop The vulnerability exists due to input sanitation...

Pivotx 2.2.0 Cross Site Scripting / Path Disclosure

================================== Vulnerability ID: HTB22788 Reference: http://www.htbridge.ch/advisory/xssinpivotx.html Product: Pivotx Vendor: Pivotx Team http://pivotx.net/ Vulnerable Version: 2.2.0 Vendor Notification: 11 January 2011 Vulnerability Type: XSS Cross Site Scripting Status:...

Multiple Vulnerabilities in ReOS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ReOS which could be exploited to perform SQL injection attacks and compromise vulnerable system. 1 SQL injection vulnerabilities in ReOS 1.1 The vulnerability exists due to input sanitation errors in the...

diafan.CMS 4.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: diafan.CMS Vendor: Diafan http://www.diafan.ru/ Vulnerable Version: 4.3 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vendor Alerted, Awaiting...

Energine 2.3.8 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: Energine Vulnerable Version: 2.3.8 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: Medium Credit: High-Tech...

VaM Shop 1.6 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1.6 and Probably Prior Versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vendor Alerted, Awaiting Vend...

Multiple Vulnerabilities in Pixelpost

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pixelpost which could be exploited to perform cross-site scripting attacks and disclose potentially sensitive information. 1 Cross-site scripting vulnerability in Pixelpost The vulnerability exists due to input...

Multiple Vulnerabilities in Pivotx

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pivotx which could be exploited to perform cross-site scripting attacks and disclose potentially sensitive information. 1 Cross-site scripting XSS vulnerabilities in Pivotx: CVE-2011-0772 1.1 The vulnerability...

XSS vulnerability in VaM Shop

Vulnerability ID: HTB22779 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinvamshop1.html Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1.6 and Probably Prior Versions Vendor Notification: 28 December 2010 Vulnerability Type: XSS Cross Site Scripting Status:...

Diafan CMS 4.3 Cross Site Request Forgery / Cross Site Scripting

====================================== Vulnerability ID: HTB22776 Reference: http://www.htbridge.ch/advisory/storedxssvulnerabilityindiafancms.html Product: diafan.CMS Vendor: Diafan http://www.diafan.ru/ Vulnerable Version: 4.3 and probably prior versions Vendor Notification: 28 December 2010...

energine 2.3.8 - Multiple Vulnerabilities

Vulnerability ID: HTB22783 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinenergine.html Product: Energine Vulnerable Version: 2.3.8 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaitin...

Phenotype CMS 3.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability ID: HTB22769 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphenotypecms.html Product: Phenotype CMS Vendor: http://www.phenotype-cms.com http://www.phenotype-cms.com Vulnerable Version: 3.0 Vendor Notification: 21...

Path disclousure in phpMySport

Vulnerability ID: HTB22773 Reference: http://www.htbridge.ch/advisory/pathdisclousureinphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21 December 2010 Vulnerability Type: Path disclosure Status: Not Fixed,...

F3Site 2011 alfa 1 XSS / CSRF Vulnerabilities

Exploit for php platform in category web applications Product: F3Site Vendor: COMPMaster http://dhost.info/compmaster/ Vulnerable Version: 2011 alfa 1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vendor...

F3Site 2011 Alfa 1 Cross Site Request Forgery / Cross Site Scripting

======================================= Vulnerability ID: HTB22757 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinf3site.html Product: F3Site Vendor: COMPMaster http://dhost.info/compmaster/ Vulnerable Version: 2011 alfa 1 and probably prior versions Vendor Notification: 21 December 2010...

phpMySport 1.4 Bypass / Path Disclosure / SQL Injection

================================== Vulnerability ID: HTB22774 Reference: http://www.htbridge.ch/advisory/authenticationbypassinphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21 December 2010 Vulnerability Type...

phpMySport 1.4 - SQL Injection / Authentication Bypass / Full Path Disclosure

Vulnerability ID: HTB22770 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

CSRF (Cross-Site Request Forgery) in Open blog

Vulnerability ID: HTB22763 Reference: http://www.htbridge.ch/advisory/csrfcrosssiterequestforgeryinopenblog.html Product: Open blog Vendor: K5 Storitve http://www.open-blog.info/ Vulnerable Version: 1.2.1 Vendor Notification: 15 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...