CVE-2011-5090

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

PT-2012-2068 · Gr Board · Gboard

Name of the Vulnerable Software and Affected Versions: GR Board aka grboard version 1.8.6.5 Community Edition Description: The issue allows remote attackers to modify or delete data without requiring authentication for certain database actions. This can be achieved by sending a request to specifi...

PT-2012-2069 · Gr Board · Gboard

Name of the Vulnerable Software and Affected Versions: GR Board version 1.8.6.5 Community Edition Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the tableType or blindTarget parameter to "view.php", the delTargets0 parameter to "view...

PT-2012-3039

Name of the Vulnerable Software and Affected Versions eFront Community++ edition version 3.6.10 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the filter parameter in the /www/administrator.php endpoint. This could potentially lead ...

Syneto Unified Threat Management 1.3.31.4.2 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Syneto Unified Threat Management 1.3.31.4.2 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/51597/info Syneto Unified Threat Management is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properl...

Multiple XSS in KnowledgeTree Community Edition

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in KnowledgeTree Community Edition, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in KnowledgeTree Community Edition: CVE-2012-0988 Input appended to the...

Metasploit 4.1.0 Web UI stored XSS vulnerability

Advisory: Metasploit 4.1.0 Web UI stored XSS vulnerability Advisory ID: SSCHADV2011-033 Author: Stefan Schurtz Affected Software: Successfully tested on Metasploit Community Edition Vendor URL: http://metasploit.com/ Vendor Status: fixed EDB-ID: 18012 ========================== Vulnerability...

Metasploit Community Edition - Advance penetration testing tool by Rapid7

Metasploit Community Edition - Advance penetration testing tool by Rapid7 Open-source penetration testing "Metasploit Framework" Rapid7 a project funded by the U.S. on October 18 U.S. time, and penetration testing tools platform to Metasploit Framework "Metasploit Community Edition" was released...

Metasploit 4.1.0 Web UI stored XSS Vulnerability

Exploit for multiple platform in category web applications Advisory: Metasploit 4.1.0 Web UI stored XSS vulnerability Advisory ID: SSCHADV2011-033 Author: Stefan Schurtz Affected Software: Successfully tested on Metasploit Community Edition Vendor URL: http://metasploit.com/ Vendor Status: inform...

EFront 3.6.9 Community Edition - Multiple Vulnerabilities

EFront 3.6.9 Community Edition - Multiple Vulnerabilities Exploit Title: EFront UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/professor.php?ctg=messages&folder= UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/admin.php?ctg=messages&folder= UNION...

EFront <= 3.6.9 Community Edition Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: EFront UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/professor.php?ctg=messages&folder= UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/admin.php?ctg=messages&folder= UNION ALL...

Cross site scripting

Cross-site scripting XSS vulnerability in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title...

PT-2011-3169

Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 6.0.0 through 6.0.5 Description The issue allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Enti...

PT-2011-3171

Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition versions 5.x through 6.0.5 Description A cross-site scripting issue allows remote authenticated users to inject arbitrary web script or HTML via a blog title. Recommendations For versions 5.x through 6.0.5,...

PT-2011-3170

Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 5.x through 6.0.5 GA Description The issue allows remote authenticated users to read arbitrary XSL and XML files. This is possible due to a flaw in the XSL Content portlet when used with Apache Tomc...

PT-2011-3228

Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 5.x through 6.0.5 GA Description The issue allows remote attackers to execute arbitrary commands. This is due to an unspecified vulnerability in the XSL Content portlet when Apache Tomcat is used...

CVE-2011-1571: Undefined Security Weakness

Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2011-1503: Exposure of Sensitive Information to an Unauthorized Actor

The XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary 1 XSL and 2 XML files via a file:/// URL...

CVE-2011-1502: Exposure of Sensitive Information to an Unauthorized Actor

Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...

CVE-2011-1570: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030...