Movable Type vulnerable to session hijacking

Overview Movable Type contains a session hijacking vulnerability. Movable Type contains a session hijacking vulnerability in entering comments and community functionality. Impact A remote unauthenticated attacker may impersonate an honest user of the affected product. Solution Update the software...

Movable Type vulnerable to cross-site request forgery

Overview Movable Type contains a cross-site request forgery vulnerability. Movable Type contains a cross-site request forgery vulnerability in entering comments and community functionality. Impact If a user views a malicious page while logged in, settings may be changed, data may be viewed or...

JVN#49836527: Movable Type vulnerable to cross-site scripting

mt-wizard.cgi and Movable Type templates contain a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version of each product according to the information provided by the developer. Products...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: tkcropthumbs, t3extplorer, tcbeuser, anpredigten, solr, pdfcontroller, cc20, jwplayer Release Date: February 23, 2012 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensio...

eFront Community++ v3.6.10 - SQL Injection Vulnerability

Title: ====== eFront Community++ v3.6.10 - SQL Injection Vulnerability Date: ===== 2012-02-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=422 VL-ID: ===== 422 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solution...

eFronts Community++ v3.6.10 - Cross Site Vulnerability

Title: ====== eFronts Community++ v3.6.10 - Cross Site Vulnerability Date: ===== 2012-02-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=423 VL-ID: ===== 423 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solutions...

CVE-2012-1048

Cross-site scripting XSS vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

CVE-2012-1048

CVE-2012-1048 describes a cross-site scripting (XSS) vulnerability in the web admin page: communityplusplus/www/administrator.php of the eFront Community++ edition (version 3.6.10, and possibly other editions). The issue allows remote attackers to inject arbitrary web script or HTML via the filte...

CVE-2012-1048

Cross-site scripting XSS vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

eFront Community++ 3.6.10 SQL Injection

Title: ====== eFront Community++ v3.6.10 - SQL Injection Vulnerability Date: ===== 2012-02-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=422 VL-ID: ===== 422 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solution...

eFront Community++ 3.6.10 - SQL Injection Multiple HTML Injection Vulnerabilities

eFront Community++ 3.6.10 - SQL Injection Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/51973/info eFront Community++ is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied...

eFront Community++ 3.6.10 - SQL Injection / Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/51973/info eFront Community++ is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues may allow an attacker to compromise the...

eFront Community++ v3.6.10 - Multiple Web Vulnerabilities

Title: ====== eFront Community++ v3.6.10 - Multiple Web Vulnerabilities Date: ===== 2012-02-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=421 VL-ID: ===== 421 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solutio...

eFront Community++ v3.6.10 - SQL Injection Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=422 Release Date: ============= 2012-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 42...

eFront Community++ v3.6.10 - SQL Injection Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=422 Release Date: ============= 2012-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 42...

eFront Community++ 3.6.10 Cross Site Scripting

Title: ====== eFront Community++ v3.6.10 - Multiple Web Vulnerabilities Date: ===== 2012-02-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=421 VL-ID: ===== 421 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solutio...

How Offensive Research Drives Down the Cost of Attacks

CANCUN–The offensive security research community has evolved in the last decade or so from a relatively small and insular group inwardly focused, to a large and rather vocal group with a wide variety of motives, opinions and skill levels. But, to hear Brad Arkin of Adobe tell it, the huge amount ...

eFront Community++ v3.6.10 - Multiple Web Vulnerabilities

Document Title: =============== eFront Community++ v3.6.10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=421 Release Date: ============= 2012-02-09 Vulnerability Laboratory ID VL-ID: ==================================== 4...

eFront Community++ v3.6.10 - Multiple Web Vulnerabilities

Document Title: =============== eFront Community++ v3.6.10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=421 Release Date: ============= 2012-02-09 Vulnerability Laboratory ID VL-ID: ==================================== 4...