ZeusCart 4.0 - Cross-Site Request Forgery

ZeusCart 4.0 - Cross-Site Request Forgery ZeusCart 4.0: CSRF Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendo...

ZeusCart 4.0 - SQL Injection

ZeusCart 4.0 - SQL Injection ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to...

ZeusCart 4.0 - SQL Injection

ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed ...

ZeusCart 4.0 - Cross-Site Request Forgery

ZeusCart 4.0: CSRF Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed to public:...

ZeusCart 4.0 Cross Site Scripting

ZeusCart 4.0: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed to public: 09/14/201...

ZeusCart 4.0 Cross Site Request Forgery

ZeusCart 4.0: CSRF Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed to public:...

ZeusCart 4.0 SQL Injection

ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed ...

ZeusCart 4.0 Code Execution

ZeusCart 4.0: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclose...

狼邦内容管理系统SQL注入漏洞 /ztcx

LBCMS是贵州狼邦科技有限公司自主开发的一套CMS，中文软件名称为： 狼邦内容管理系统，版本目前是V8.0，开发语言: ASP.NET 4.0，数据库: SQL2005， 运行环境: Windows2003/NT系统+IIS6.0 ，主要应用于贵州或其它地区的政府、学校、企事业单位、个人网站建设。 LBCMS存在一处SQL报错注入漏洞： /Webwsfw/ztcx/?bh=1 测试案例： http://www.gzfwz.com/Webwsfw/ztcx/?bh=1 报错形式注入 sqlmap证明 !/usr/bin/env python coding: utf-8 from...

CVE-2015-2987

The CVE-2015-2987 issue affects Type74 ED before 4.0, where 128-bit ECB is misused for small files, enabling plaintext exposure via differential cryptanalysis when the file’s original length is

Server: Calendar export: Authorization Bypass Through User-Controlled Key

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

CVE-2015-3439

Cross-site scripting XSS vulnerability in the Ephox formerly Moxiecode plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as...

CVE-2012-6695

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value...

CVE-2012-6694

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system o...

Hardcoded credentials

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value...

Hardcoded credentials

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of 1 CANal1 for the Administrator user and 2 iis for the IIS user, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on...

CVE-2012-6693

GE Healthcare Centricity PACS 4.0 Server has a default password of 1 nasro for the nasro ReadOnly user and 2 nasrw for the nasrw Read/Write user, which has unspecified impact and attack vectors...

CVE-2012-6694

CVE-2012-6694 involves GE Healthcare Centricity PACS Workstation 4.0/4.0.1 and Centricity PACS Server 4.0 where the geservice account uses the default/hard-coded password 2charGE. This credential issue is associated with potential unauthorized access and remote exploitation, as documented in ICS-...

CVE-2012-6695

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value...

CVE-2012-6693

CVE-2012-6693 concerns GE Healthcare Centricity PACS Server with default credentials: nasro / nasro (ReadOnly) and nasrw (Read/Write). The connected documents confirm a default credential issue across Centricity PACS components, enabling remote access with these accounts. The primary root cause i...