[ACM, Ariadne Content Manager] unauth. SQL injection + user enumeration

Hi sec-folks, I recently discuss with Ariadne team to public disclose two new different vulnerabilities found in Ariadne Content Manager ACM. As the name says, ACM is an enterprise solution for content management mainly used by big private and public companies and institutions. This is the site o...

AWCM v2.2 Auth Bypass Vulnerabilities

AWCM v2.2 Auth Bypass Vulnerabilities / / / / L /' / , / / /' , / /' /' / /' / / / / / / L / / / // // // ///////////L // ////// // //...

CA Secure Content Manager FTP Gateway LIST Command Buffer Overflow (CVE-2008-2541)

CA eTrust Secure Content Manager SCM is a gateway product for Windows platform that secures, monitors, filters and blocks potential threats from messaging and Web traffic. It provides protection against malware, spam, phishing, P2P file sharing and prevents access to known spyware sites. All CA S...

CVE-2010-2896

IBM FileNet Content Manager CM 4.0.0, 4.0.1, 4.5.0, and 4.5.1 before FP4 does not properly manage the InheritParentPermissions setting during an upgrade from 3.x, which might allow attackers to bypass intended folder permissions via unspecified vectors...

Design/Logic Flaw

IBM FileNet Content Manager CM 4.0.0, 4.0.1, 4.5.0, and 4.5.1 before FP4 does not properly manage the InheritParentPermissions setting during an upgrade from 3.x, which might allow attackers to bypass intended folder permissions via unspecified vectors...

CVE-2010-2896

CVE-2010-2896 affects IBM FileNet Content Manager (CM) versions 4.0.0, 4.0.1, 4.5.0, and 4.5.1 prior to FP4. The root cause is improper handling of the InheritParentPermissions setting during an upgrade from 3.x, which may allow an attacker to bypass intended folder permissions via unspecified ve...

Multiple vulnerabilities in MC Content Manager

Hello Bugtraq! I want to warn you about Cross-Site Scripting and SQL Injection vulnerabilities in MC Content Manager. Which I found in this CMS in 2007 and 2009 at the site of SZRU Foreign Intelligence Service of Ukraine - it's Ukrainian special service similar to CIA and MI6 SIS. From 8...

MC Content Manager Cross Site Scripting / SQL Injection

Hello Bugtraq! I want to warn you about Cross-Site Scripting and SQL Injection vulnerabilities in MC Content Manager. Which I found in this CMS in 2007 and 2009 at the site of SZRU Foreign Intelligence Service of Ukraine - it's Ukrainian special service similar to CIA and MI6 SIS. From 8...

MC Content Manager 10.1 - SQL Injection Cross-Site Scripting

MC Content Manager 10.1 - SQL Injection Cross-Site Scripting source: https://www.securityfocus.com/bid/41949/info MC Content Manager is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiti...

MC Content Manager 10.1 - SQL Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/41949/info MC Content Manager is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

Information disclosure

Unspecified vulnerability in the P8 Content Engine P8CE 4.5.1 before FP3 and the P8 Content Search Engine P8CSE before 4.5.0 FP3 and 4.5.1 before FP1, as used in IBM FileNet P8 Content Manager CM and FileNet P8 Business Process Manager BPM, allows remote attackers to gain privileges via unknown...

FreeBSD : e107 -- code execution and XSS vulnerabilities (a4746a86-4c89-11df-83fb-0015587e2cc1)

Secunia Research reported two vulnerabilities in e107 : The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the 'contentheading' parameter correctly and is therefore vulnerable to a cross site scripting attack. The second vulnerabili...

e107 -- code execution and XSS vulnerabilities

Secunia Research reported two vulnerabilities in e107: The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the "contentheading" parameter correctly and is therefore vulnerable to a cross site scripting attack. The second vulnerabilit...

CVE-2010-1066

AR Web Content Manager AWCM 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/dbbackup.php...

Improper access control

AR Web Content Manager AWCM 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/dbbackup.php...

CVE-2010-1066

AWCM 2.1 stores sensitive data under the web root with insufficient access control, enabling remote attackers to download the database via a direct request to control/db_backup.php. Impact is database disclosure; no exploit details are provided in the connected documents. Remediation not specifie...

CVE-2010-1041

Unspecified vulnerability in the single sign-on functionality in the Web Services implementation in IBM DB2 Content Manager CM Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13 has unknown impact and remote attack vectors...

Code injection

Unspecified vulnerability in the single sign-on functionality in the Web Services implementation in IBM DB2 Content Manager CM Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13 has unknown impact and remote attack vectors...

CVE-2010-1041

Unspecified vulnerability in the single sign-on functionality in the Web Services implementation in IBM DB2 Content Manager CM Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13 has unknown impact and remote attack vectors...

CVE-2010-1041

The CVE-2010-1041 entry concerns IBM DB2 Content Manager (CM) Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13. The vulnerability is in the single sign-on Web Services implementation; the root cause is not specified in the available documents. Impact is d...