5281 matches found
PT-2014-91: Cross-Site Scripting in ShopOS
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in ShopOS. Reflected cross-site scripting in the index.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to...
PT-2014-81: Two Local File Inclusion Vulnerabilities in ShopOS
The specialists of the Positive Research center have detected two Local File Inclusion vulnerabilities in ShopOS. Insufficient validation of user input in the configuration.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may resul...
JForum 'adminUsers' Module - Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/64540/info JForum is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the...
[OWASP CSRFTester] Facilitates Ability to Test Applications for CSRF
OWASP CSRFTester is a tool for testing CSRF vulnerability in websites. Just when developers are starting to run in circles over Cross Site Scripting, the 'sleeping giant' awakes for yet another web-catastrophe. Cross-Site Request Forgery CSRF is an attack whereby the victim is tricked into loadin...
PT-2014-71: Cross-Site Scripting in Jahia CMS
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Reflected cross-site scripting in the groupsearch.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browse...
PT-2014-73: Two Cross-Site Scripting vulnerabilities in Jahia CMS
The specialists of the Positive Research center have detected two Cross-Site Scripting vulnerabilities in Jahia CMS. Two reflected cross-site scripting vulnerabilities in the ManageGroups.java script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a pag...
PT-2014-74: Cross-Site Scripting in Jahia CMS
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Stored cross-site scripting in the ManageSiteLanguages.java script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user'...
Leed - id SQL Injection
Leed - id SQL Injection source: https://www.securityfocus.com/bid/64426/info Leed is prone to an SQL-injection vulnerability. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...
PHP - openssl_x509_parse() Memory Corruption
PHP - opensslx509parse Memory Corruption SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PHP opensslx509parse Memory Corruption Vulnerability Release Date: 2013/12/13 Last Modified: 2013/12/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: PHP 4.0.6 - PHP 4.4...
InstantCMS 1.10.3 - Blind SQL Injection
Advisory ID: HTB23185 Product: InstantCMS Vendor: InstantSoft Vulnerable Versions: 1.10.3 and probably prior Tested Version: 1.10.3 Advisory Publication: November 20, 2013 without technical details Vendor Notification: November 20, 2013 Vendor Patch: November 21, 2013 Public Disclosure: December...
iScripts AutoHoster - invno SQL Injection
iScripts AutoHoster - invno SQL Injection source: https://www.securityfocus.com/bid/64377/info iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the applicatio...
iScripts AutoHoster - 'invno' SQL Injection
source: https://www.securityfocus.com/bid/64377/info iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit laten...
Etoshop B2B Vertical Marketplace Creator - Multiple SQL Injections
source: https://www.securityfocus.com/bid/64332/info B2B Vertical Marketplace Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating the SQL quer...
Nagios XI - tfPassword SQL Injection
Nagios XI - tfPassword SQL Injection source: https://www.securityfocus.com/bid/63754/info Nagios XI is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...
PT-2014-76: Cross-Site Scripting in Kasseler CMS
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the engine.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fi...
PT-2013-76: Local File Inclusion in LiveStreet CMS
The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in LiveStreet CMS. Insufficient validation of user input in the install\index.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...
[Wapiti 2.3.0] Web Application Vulnerability Scanner
Wapiti allows you to audit the security of your web applications. It performs "black-box" scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets this list, Wapiti act...
Debian Security Advisory DSA 2809-1 (ruby1.8 - several vulnerabilities)
Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1821 Ben Murphy discovered that unrestricted entity expansion in REXML can lead to a Denial of Service by consuming a...
Thousands of websites based on Ruby on Rails vulnerable to Cookie Handling flaw
Ruby on Rails contains a flaw in its design that may allow attackers to more easily access applications. Websites that rely on Ruby on Rails’s default cookie storage mechanism CookieStore are at risk. The vulnerability was actually reported two months ago, but still thousands of website are runni...
