Moderate: Red Hat Security Advisory: JBoss Enterprise Data Services Platform 5.3.0 update

JBoss Enterprise Data Services Platform 5.3.0 roll up patch 1, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVS...

The company's customer information and tracking management system CITMS 3.0 injection and upload vulnerabilities-vulnerability warning-the black bar safety net

Management system part of the function is as follows: （１）online add, modify, delete administrators （２）online add, modify, delete customer records, supporting HTML, etc.. （３）the front Desk recorded with the tracking function.． As well as the track record and the number of clicks on the display...

NeoBill CMS 0.8 Alpha - Multiple Vulnerabilities

Title: ====== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities Date: ===== 2012-08-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=685 VL-ID: ===== 685 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

Microsoft Changes Mind; Will Patch Flash on IE 10 Before Windows 8 Ships

Microsoft has reversed course and said it will patch a serious Adobe Flash vulnerability in Windows 8 and Internet Explorer 10 before the new Microsoft OS ships Oct. 26. Microsoft had previously said it would wait until after the ship date to update Flash, which is integrated into the browser...

Kayako Fusion 4.40.1148 Cross Site Scripting

Advisory ID: HTB23095 Product: Kayako Fusion Vendor: Kayako Vulnerable Versions: 4.40.1148 and probably prior Tested Version: 4.40.1148 Vendor Notification: June 6, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-3233 CVSSv2 Base...

CVE-2011-5109

Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to 1 categorylist.php, 2 Copyofcalendarlist.php, 3 customerstatisticslist.php, 4 customerlist.php, and 5...

xt:Commerce <= v3.04 SP2.1 Time Based Blind SQL Injection

Exploit for php platform in category web applications +---------------------------------+ | xt:Commerce = v3.04 SP2.1 | | commerce:SEO = v2.1 CE | | Gambio = v2.0.10 SP1.4 | | Time Based Blind SQL Injection | +---------------------------------+ Author.............: Ralf Zimmermann...

PT-2012-5309

Name of the Vulnerable Software and Affected Versions Travelon Express version 6.2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "holiday.php" and "holiday book.php" using the hid parameter, "pages.php"...

CVE-2012-4281: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to 1 holiday.php or 2 holidaybook.php, 3 id parameter to pages.php, 4 fid parameter to admin/airline-edit.php, or 5 cid parameter to...

ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities

Document Title: =============== ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=670 Release Date: ============= 2012-08-01 Vulnerability Laboratory ID VL-ID: ==================================== 67...

Millions of Mobile Phone Users' Data Leaked in South Korea Scam

Two men have been arrested in South Korea for allegedly leaking the information of almost nine million of the nation’s mobile phone users, including details of the users’ monthly plans, according to a report issued by the Korea National Police Agency’s KNPA Cyber Terror Response Center CTRC over...

4XP Critical SQL Injection Vulnerability Exposed

zSecure team has recently discovered a critical SQL Injection Vulnerability in the web portal of 4XP, a leading online forex broker having more than 1 lakh customer base. Financial transactions are carried on the broker's paltform on daily basis including but not limited to Credit Card...

Avaya IP Office Customer Call Reporter code execution

It's possible to upload executable files via ImageUpload.ashx...

Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities

Document Title: =============== Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=631 Release Date: ============= 2012-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 6...

CVE-2012-3811

Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an...

CVE-2012-3811

CVE-2012-3811 affects Avaya IP Office Customer Call Reporter (CCR) ImageUpload.ashx, where an unrestricted file upload allows remote code execution by uploading an executable and accessing it directly. Affected: CCR 7.0 up to 7.0.5.8 Q1 2012 Maintenance Release and 8.0 up to 8.0.9.13 Q1 2012 Main...

CVE-2012-3811

Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an...

CVE-2012-3811: Undefined Security Weakness

Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an...

PT-2012-5014

Name of the Vulnerable Software and Affected Versions Avaya IP Office Customer Call Reporter versions 7.0 through 7.0.5.8 Avaya IP Office Customer Call Reporter versions 8.0 through 8.0.9.13 Description The issue concerns an unrestricted file upload vulnerability in the ImageUpload.ashx component...

Avaya IP Office Customer Call Reporter ImageUpload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avaya IP Office Customer Call Reporter. Authentication is not required to exploit this vulnerability. The specific flaw exists because Avaya IP Office Customer Call Reporter allows unauthenticated...