OpenEMR 4.1 - Interfacefaxfax_dispatch.php?File exec() Call Arbitrary Shell Command Execution

OpenEMR 4.1 - Interfacefaxfaxdispatch.php?File exec Call Arbitrary Shell Command Execution source: https://www.securityfocus.com/bid/51788/info OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input. A remote attacker...

Annuaire PHP XSS Vulnerability (Jan 2012) - Active Check

Annuaire PHP is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Joomla! Component JE Story Submit - index.php Arbitrary File Upload

Joomla! Component JE Story Submit - index.php Arbitrary File Upload source: https://www.securityfocus.com/bid/51657/info The 'comjesubmit' component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplie...

Joomla! Component com_xball - 'team_id' SQL Injection

source: https://www.securityfocus.com/bid/51618/info The 'comxball' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

Joomla! Component com_br - 'Controller' Local File Inclusion

source: https://www.securityfocus.com/bid/51613/info The 'combr' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and execute...

Joomla! Component Full - 'id' SQL Injection

source: https://www.securityfocus.com/bid/51616/info The Full 'comfull' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

Microsoft Anti-XSS Library Bypass

No description provided by source. Microsoft Anti-XSS Library is used to protect applications from Cross-Site Scripting attacks, by providing methods for input sanitization. Vulnerability ------------- Microsoft Anti-XSS Library 3.0 and 4.0 are vulnerable to an attack in which an attacker is able...

Symantec Endpoint Protection Manager Cross-Site Request Forgery and Cross-Site Scripting

SUMMARY Symantec Endpoint Protection Manager 12.1 web console is susceptible to cross-site scripting and cross-site request forgery that could potentially lead to arbitrary code execution. AFFECTED PRODUCTS Product | Version | Build | Solutions ---|---|---|--- Symantec Endpoint Protection | 12.1 ...

Plone Zope SAXutils Command Execution

Added: 01/13/2012 CVE: CVE-2011-3587 BID: 49857 OSVDB: 76105 Background Plone is a free and open source content management system built on top of the Zope application server. Plone can be used for any kind of website, including blogs, internet sites, webshops and internal websites. Problem Plone...

SAPID CMS <= 1.2.3 Multiple RFI Vulnerabilities - Active Check

SAPID CMS is prone to multiple remote file include RFI vulnerabilities because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Clipbucket 2.6 - view_collection.php?type Cross-Site Scripting

Clipbucket 2.6 - viewcollection.php?type Cross-Site Scripting source: https://www.securityfocus.com/bid/51321/info ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiti...

Marinet CMS - 'galleryphoto.php?id' SQL Injection

source: https://www.securityfocus.com/bid/51336/info Marinet CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

Clipbucket 2.6 - 'view_collection.php?type' Cross-Site Scripting

source: https://www.securityfocus.com/bid/51321/info ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal...

Marinet CMS - room2.php?roomid SQL Injection

Marinet CMS - room2.php?roomid SQL Injection source: https://www.securityfocus.com/bid/51336/info Marinet CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could...

Clipbucket 2.6 - 'groups.php?cat' Cross-Site Scripting

source: https://www.securityfocus.com/bid/51321/info ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal...

Atar2b CMS 4.0.1 - 'pageE.php?id' SQL Injection

source: https://www.securityfocus.com/bid/51317/info Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

ImpressPages CMS 'actions.php' RCE Vulnerability

ImpressPages CMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QuiXplorer 'index.php' Arbitrary File Upload Vulnerability

QuiXplorer is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

Limny 3.0.1 - login.php Script Cross-Site Scripting

Limny 3.0.1 - login.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...

Hastymail rs parameter command injection

Added: 12/28/2011 CVE: CVE-2011-4542 BID: 50791 OSVDB: 77331 Background Hastymail is a fast, secure, rfc-compliant, cross-platform IMAP/SMTP client application written in PHP providing a clean web interface for sending and reading E-mail. Problem Hastymail2 fails to properly sanitize user-supplie...