SimpleInvoices 2011.1 Cross-Site-Scripting (XSS) Vulnerabilities CVE-2012-4932

Overview SimpleInvoices 2011.1 is vulnerable to Cross-site Scripting XSS. Software Description Simple Invoices is a free, open source, web based invoicing system that you can install on your server/pc or have hosted by one of our services providers. Vulnerability Overview The vulnerabilities POC...

SimpleInvoices 2011.1 Cross Site Scripting

Overview SimpleInvoices 2011.1 is vulnerable to Cross-site Scripting XSS. Software Description Simple Invoices is a free, open source, web based invoicing system that you can install on your server/pc or have hosted by one of our services providers. Vulnerability Overview The vulnerabilities POC...

CVE-2012-5791

PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Code injection

PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5791

PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5791

CVE-2012-5791 concerns PayPal Invoicing, where the SSL/TLS hostname verification is not performed against the certificate’s CN or subjectAltName. This allows MITM attackers to spoof SSL servers by presenting a valid certificate. The provided records describe the issue and its impact (partial conf...

CVE-2012-5791: Improper Input Validation

PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2012-6103

Name of the Vulnerable Software and Affected Versions PayPal Invoicing affected versions not specified Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This allows...

NeoInvoice Blind SQL Injection

NeoInvoice is a multi-tenant open source invoicing system, that currently contains an unauthenticated blind SQL injection condition in signupcheck.php. The input for the value field isn't being properly sanitized, and is used in string concatenation to create the SQL query. See here for the...