PT-2008-4800 · Runesoft · Cerberus Cms

Name of the Vulnerable Software and Affected Versions: Runesoft Cerberus CMS versions prior to 3 1.4 0.9 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a cerberus user cookie. This enables attackers to execute malicious scripts on...

Cerberus Helpdesk控制器认证信息泄露漏洞

BUGTRAQ ID: 29347 Cerberus HelpDesk是一款电子邮件管理工具，可以有效而且快速的处理处理垃圾邮件、病毒邮件等。 Cerberus HelpDesk认证非标准helpdesk页面的控制器（应用中的第一个/slash命令，如/display或/kb）的方式存在漏洞，与Web接口无关的功能（如/cron）基于使用情况处理自己的认证。如果攻击者访问了某些员工端helpdesk URL的话，就可以查看文件附件消息。 Cerberus Helpdesk 4.0 Cerberus -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface in Cerberus FTP Server before 2.46 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5930

Cross-site scripting XSS vulnerability in the web interface in Cerberus FTP Server before 2.46 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5930

CVE-2007-5930 is a Cross-site scripting (XSS) vulnerability in the Cerberus FTP Server web interface before version 2.46. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. According to NVD, impact is partial integrity with no confidentiality or avai...

CVE-2007-5930

Cross-site scripting XSS vulnerability in the web interface in Cerberus FTP Server before 2.46 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2003-1476

Cerberus FTP Server 2.1 stores usernames and passwords in plaintext, which could allow local users to gain access...

CVE-2003-1476

CVE-2003-1476 affects Cerberus FTP Server 2.1. The provided documents describe a plaintext storage of usernames and passwords, which could allow local users to gain access. This disclosure aligns with a local-privilege concern but the connected sources do not provide explicit exploit vectors, imp...

CVE-2006-6366

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...

CVE-2006-6366

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...

CVE-2006-6366

Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...

Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting

Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Cerberus Helpdesk 2.x - 'Spellwin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecti...

Cerberus Helpdesk rpc.php Information Disclosure

Binary data 3797.prm...

CVE-2006-5428

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

CVE-2006-5428

rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a displaygetrequesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information ticket data via a direct request...

CVE-2006-5428

CVE-2006-5428 : Cerberus Helpdesk 3.2.1 contains an information-disclosure flaw in rpc.php where it does not verify a client’s privileges for display_get_requesters. This allows an unauthenticated or improperly authenticated user to bypass the GUI login and directly retrieve sensitive ticket data...

Cerberus Helpdesk rpc.php Arbitrary Ticket Information Disclosure

The remote host is running Cerberus Helpdesk, a web-based helpdesk suite written in PHP. The installed version of Cerberus Helpdesk on the remote host allows an unauthenticated attacker to retrieve information about ticket requesters through the 'rpc.php' script. %NASLMINLEVEL 70300 C Tenable...

Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access

source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available. An attacker can exploit this vulnerability t...

Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access

Cerberus Helpdesk 3.2.1 - Rpc.php Unauthorized Access source: https://www.securityfocus.com/bid/20598/info Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is...