eyeOS 1.9.0.2 Cross Site Scripting

Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. -...

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal message...

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files

Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. -...

eyeOS 1.9.0.2 - Image File Handling HTML Injection

source: https://www.securityfocus.com/bid/47629/info eyeOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input passed through image content before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the...

eyeOS 1.9.0.2 - Image File Handling HTML Injection

eyeOS 1.9.0.2 - Image File Handling HTML Injection source: https://www.securityfocus.com/bid/47629/info eyeOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input passed through image content before using it in dynamically generated content...

EyeOS file Parameter Directory Traversal

The version of EyeOS hosted on the remote host includes a PHP script, devtools/qooxdoo-sdk/framework/source/resource/qx/test/part/delay.php, that fails to sanitize input to the 'file' parameter before using it to return the contents of a file from the remote host. An unauthenticated, remote...

CVE-2011-1714

Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

Directory traversal

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1715

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1714

The vulnerability is an XSS in QooxDoo’s jsonp_primitive.php (framework/source/resource/qx/test/jsonp_primitive.php) affecting QooxDoo 1.3 and possibly other versions, as used by eyeOS 2.2/2.3. The underlying issue is reflected script injection via the callback parameter. Current documents do not...

CVE-2011-1715

CVE-2011-1715 describes a directory traversal vulnerability in EyeOS-integrated QooxDoo components (notably the file devtools/qooxdoo-sdk/framework/source/resource/qx/test/part/delay.php). The flaw allows remote attackers to read arbitrary files by supplying encoded dot-dot sequences in the file ...

CVE-2011-1714: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

CVE-2011-1715: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

eyeOS 2.3 Multiple Vulnerabilities

Exploit for php platform in category web applications ------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discover...

eyeos 2.3 - Multiple Vulnerabilities

eyeos 2.3 - Multiple Vulnerabilities ------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery...

eyeOS 2.3 Cross Site Scripting

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Reflected Cross-site Scripting Threat Level............Low 1/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested...

eyeOS 2.3 Local File Inclusion

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested On...............Windo...

eyeos 2.3 - Multiple Vulnerabilities

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested On...............Windo...

FreeBSD Ports: eyeOS

The remote host is missing an update to the system as announced in the referenced advisory. VID d3527663-4ccb-11db-b48d-00508d6a62df OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: eyeOS

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...