PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability

High-Tech Bridge reports: Input passed via the "file" GET parameter to /pivotx/ajaxhelper.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of the affected website...

PluXml 5.1.5 - Local File Inclusion

PluXml 5.1.5 - Local File Inclusion Advisory ID: HTB23086 Product: PluXml Vendor: pluxml.org Vulnerable Versions: 5.1.5 and probably prior Tested Version: 5.1.5 Vendor Notification: 11 April 2012 Vendor Patch: 16 April 2012 Public Disclosure: 2 May 2012 Vulnerability Type: Local File Inclusion CV...

Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...

XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities

XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities Advisory ID: HTB23062 Product: XOOPS Vendor: xoops.org Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability...

newscoop 3.5.3 - Multiple Vulnerabilities

Advisory ID: HTB23084 Product: Newscoop Vendor: Sourcefabric o.p.s. Vulnerable Versions: 3.5.3 and probably prior, partially 4.0 RC3 Tested Version: 3.5.3 Vendor Notification: 28 March 2012 Vendor Patch: 5 April 2012 Public Disclosure: 18 April 2012 Vulnerability Type: Remote File Inclusion, SQL...

Сross-Site Request Forgery (CSRF) in TestLink

High-Tech Bridge Security Research Lab has discovered vulnerabiliy in TestLink, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in TestLink: CVE-2012-2275 The application allows authorized users to perform certain actions via HTTP...

Newscoop 3.5.3 XSS / RFI / SQL Injection

Advisory ID: HTB23084 Product: Newscoop Vendor: Sourcefabric o.p.s. Vulnerable Versions: 3.5.3 and probably prior, partially 4.0 RC3 Tested Version: 3.5.3 Vendor Notification: 28 March 2012 Vendor Patch: 5 April 2012 Public Disclosure: 18 April 2012 Vulnerability Type: Remote File Inclusion, SQL...

XOOPS 2.5.4 Cross Site Scripting

Advisory ID: HTB23062 Product: XOOPS Vendor: xoops.org Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability Type: XSS Cross Site Scripting CVE References: CVE-2012-098...

kernel security, bug fix, and enhancement update

2.6.18-308.4.1.el5 - net ipv6: fix skb double free in xfrm6tunnel Jiri Benc 752305 743375 CVE-2012-1583 2.6.18-308.3.1.el5 - net be2net: cancel beworker during EEH recovery Ivan Vecera 805462 773735 - net be2net: add vlan/rx-mode/flow-control config to besetup Ivan Vecera 805462 773735 - x86...

WordPress All-In-One Event Calendar 1.4 Cross Site Scripting

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...

Multiple vulnerabilities in Open Journal Systems (OJS)

Advisory ID: HTB23079 Product: Open Journal Systems OJS Vendor: Public Knowledge Project Vulnerable Versions: 2.3.6 and probably prior Tested Version: 2.3.6 Vendor Notification: 29 February 2012 Vendor Patch: 16 March 2012 Public Disclosure: 21 March 2012 Vulnerability Type: Arbitrary File...

Multiple vulnerabilities in Elefant CMS

Advisory ID: HTB23076 Product: Elefant CMS Vendor: Elefant CMS Vulnerable Versions: 1.1.3 beta and probably prior Tested Version: 1.1.3 beta Vendor Notification: 22 February 2012 Vendor Patch: 22 February 2012 Public Disclosure: 14 March 2012 Vulnerability Type: SQL Injection, XSS Cross Site...

Multiple XSS in Chyrp

Advisory ID: HTB23073 Product: Chyrp Vendor: Chyrp Vulnerable Versions: 2.5b1 and probably prior Tested Version: 2.5b1 Vendor Notification: 1 February 2012 Vendor Patch: 2 February 2012 Public Disclosure: 22 February 2012 Vulnerability Type: Cross Site Scripting XSS CVE References: CVE-2012-1001...

Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Ubuntu: Security Advisory (USN-1394-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1394-1 : Linux kernel (OMAP4) vulnerabilities

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. CVE-2011-1927 Vegard Nossum discovered a leak in the kernel's inotifyinit system call. A local, unprivileged user could exploit...

Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1387-1)

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. CVE-2011-1927 A flaw was found in the Linux Ethernet bridge's handling of IGMP Internet Group Management Protocol packets. An...

Ubuntu: Security Advisory (USN-1387-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for linux USN-1379-1

Ubuntu Update for Linux kernel vulnerabilities USN-1379-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13791.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for linux USN-1379-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...