evergreen-line.com XSS vulnerability

Open Bug Bounty ID: OBB-716064 Description| Value ---|--- Affected Website:| evergreen-line.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

evergreen-marine.com XSS vulnerability

Open Bug Bounty ID: OBB-716060 Description| Value ---|--- Affected Website:| evergreen-marine.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

evergreen-shipping.us Open Redirect vulnerability

Open Bug Bounty ID: OBB-560765 Description| Value ---|--- Affected Website:| evergreen-shipping.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Evergreen Information Disclosure Vulnerability

Evergreen is an open source, highly scalable library system ILS developed by the Evergreen community. The system helps patrons find library materials and helps with library management, organizing catalogs, and distributing those materials, among other things. A security vulnerability exists in th...

CVE-2015-2204

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ousetting.ancestordefault to enforce viewperm when no auth token is...

CVE-2015-2203

Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFFLOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL...

CVE-2013-7435

The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fmIDL.xml...

Design/Logic Flaw

The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fmIDL.xml...

Design/Logic Flaw

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ousetting.ancestordefault to enforce viewperm when no auth token is...

Code injection

Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFFLOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL...

CVE-2013-7435

CVE-2013-7435 details (Evergreen ILS) Affected software: Evergreen open-ils.pcrud endpoint (library system) prior to versions 2.5.9, 2.6.x prior to 2.6.7, and 2.7.x prior to 2.7.4. Root cause: a permission gap in fm_IDL.xml enables retrieval of the settings history without proper authorization. I...

CVE-2015-2204

Affected software: Evergreen ILS (open-ils) prior to specific patch levels. The vulnerability arises when open-ils.actor.ou_setting.ancestor_default fails to enforce view_perm in the absence of an auth token, allowing remote attackers to view sensitive org unit settings. Impact is information dis...

CVE-2015-2203

Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFFLOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL...

CVE-2013-7435

The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fmIDL.xml...

CVE-2015-2204

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ousetting.ancestordefault to enforce viewperm when no auth token is...

CVE-2015-2203

Evergreen is affected: versions 2.5.9, 2.6.7, and 2.7.4 expose sensitive settings history to remote authenticated users with STAFF_LOGIN by abusing listing of open-ils.pcrud as a controller in the IDL. Root cause involves information disclosure due to improper control over open-ils.pcrud exposure...

intra.myevergreen.com XSS vulnerability

Vulnerable URL: http://intra.myevergreen.com/order/OrderList.asp?Wholesid=1"...

kernel update for Evergreen 11.4 (important)

This kernel update fixes the well known "Dirty COW" issue as well as a bunch of other security and non-security related issues...

Weak Password Vulnerability in EVERGREEN's Broadband Billing System

EVERGETTING BROADBAND BILLING SYSTEM is to support a variety of user authentication methods. A weak password vulnerability exists in EVERJETSON Broadband Billing System. The presence of default passwords hsj/hsj, jixunadmin/ jixunadmin allows attackers to exploit the vulnerability to obtain...

kernel update for Evergreen 11.4, includes leap second deadlock fix (important)

kernel update for Evergreen 11.4, includes leap second deadlock fix and fixes for other security and stability issues...