firmCHANNEL Indoor & Outdoor Digital Signage 3.24 Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/32107/info firmCHANNEL Indoor & Outdoor Digital SIGNAGE is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitra...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

Sql injection

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...

CVE-2013-4889

Multiple cross-site request forgery CSRF vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new administrator via the AddUser action or 2 conduct cross-site scripting XSS attacks, as demonstrat...

CVE-2013-4888

CVE-2013-4888 (Digital Signage Xibo 1.4.2) is a documented XSS in index.php via the layout parameter on the layout page; CVE-2013-4889 describes CSRF that can hijack admin actions (e.g., AddUser) and, as noted, can enable XSS through the same page. Exploitation details are present (e.g., CSRF exp...

CVE-2013-4887

CVE-2013-4887 affects Digital Signage Xibo 1.4.2. The vulnerability is a SQL injection in the web interface (index.php) that can be exploited via the displayid parameter to execute arbitrary SQL commands. Documented impact indicates remote attackers may obtain partial confidentiality/integrity/av...

CVE-2013-4887

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...

CVE-2013-4889

CVE-2013-4889 is a vulnerability in Digital Signage Xibo 1.4.2 where CSRF in index.php can hijack administrator sessions by performing actions such as adding a new administrator via the AddUser action. The entry aggregates related issues, noting that this vulnerability enables requests performed ...

PT-2014-2876

Name of the Vulnerable Software and Affected Versions Digital Signage Xibo version 1.4.2 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the displayid parameter in the "index.php" file. Recommendations For Digital Signage Xibo...

Xibo - Cross-Site Request Forgery

Xibo - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/62064/info Xibo is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks...

Xibo 1.2.2 / 1.4.1 Directory Traversal

Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References: http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-DS-2013-00 Affected Vendor: Spring Signage Ltd Affected...

Xibo 1.2.21.4.1 - index.php?p Directory Traversal

Xibo 1.2.21.4.1 - index.php?p Directory Traversal Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References:...

Xibo 1.2.2 and 1.4.1 Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References:...

Xibo 1.2.2/1.4.1 - 'index.php?p' Directory Traversal

Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References: http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-DS-2013-00 Affected Vendor: Spring Signage Ltd Affected...

FirmChannel Digital Signage 3.24 Cross-site scripting

Title: FirmChannel Digital Signage 3.24 Cross-site scripting ------------------------------------------------------------- Vendor: FirmChannel Vendor URL: www.firmchannel.com Vendor Response: Vendor has been notified and has since addressed the issue in the latest software release. Description: A...

CVE-2008-4931

Cross-site scripting XSS vulnerability in the account module in firmCHANNEL Digital Signage 3.24, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2008-4931

Cross-site scripting XSS vulnerability in the account module in firmCHANNEL Digital Signage 3.24, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2008-4931

FirmChannel Digital Signage 3.24 (account module) contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary script via the action parameter to index.php. Findings across sources indicate the issue affects 3.24 and possibly earlier versions, with remediation i...

firmchannel-xss.txt

Title: FirmChannel Digital Signage 3.24 Cross-site scripting ------------------------------------------------------------- Vendor: FirmChannel Vendor URL: www.firmchannel.com Vendor Response: Vendor has been notified and has since addressed the issue in the latest software release. Description: A...