CVE-2015-4639

CVE-2015-4639 describes a cross-site scripting (XSS) vulnerability in Koha’s opac-addbybiblionumber.pl. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted list name in Koha versions: 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1. Exploi...

CVE-2015-4639: Cross-Site Request Forgery (CSRF)

Cross-site scripting XSS vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name...

lib.thb.gov.tw XSS vulnerability

Vulnerable URL: http://lib.thb.gov.tw/cgi-bin/koha/opac-alert-subscribe.pl?externalid=36=issue=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

Koha Cross-Site Scripting Vulnerability

Koha is the first open source library automation system. Koha suffers from a cross-site scripting vulnerability that allows an attacker to exploit the vulnerability to execute attacker-supplied HTML and script code in the context of an affected browser...

Koha HTML Injection Vulnerability

Koha is the first open source library automation system. Koha suffers from an HTML injection vulnerability that allows an attacker to execute attacker-supplied HTML and script code in the context of an affected browser...

Koha Directory Traversal Vulnerability

Koha is the first open source library automation system. Koha suffers from a directory traversal vulnerability that could be exploited by an attacker to read arbitrary files...

Koha Cross-Site Request Forgery Vulnerability

Koha is the first open source library automation system. Koha suffers from a cross-site request forgery vulnerability that could be exploited by an attacker to perform unauthorized operations...

Koha SQL Injection Vulnerability

Koha is the first open source library automation system. Koha suffers from an SQL injection vulnerability that could be exploited by an attacker to access or modify database data...

Koha 3.20.1 - Path Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

Koha 3.20.1 - Multiple SQL Injections

Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor Homepage: koha-community.or...

Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit Title: Koha Open Source ILS - Multiple XSS and XSRF Vulnerabilities Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor Homepage: koha-community.or...

Koha 3.20.1 - Multiple SQL Injections

Koha 3.20.1 - Multiple SQL Injections Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

Koha 3.20.1 - Multiple XSS and XSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Koha Open Source ILS - Multiple XSS and XSRF Vulnerabilities Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

Koha 3.20.1 - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

Koha 3.20.1 - Directory Traversal

Koha 3.20.1 - Directory Traversal Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor...

Koha ILS 3.20.x CSRF / XSS / Traversal / SQL Injection

=============================================================================================== SBA Research Vulnerability Disclosure =============================================================================================== title: Koha Unauthenticated SQL injection product: Koha ILS affecte...

Koha 3.20.1 - Directory Traversal

Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor Homepage: koha-community.org...

Koha 3.20.1 - Multiple Cross-Site Scripting Cross-Site Request Forgery Vulnerabilities

Koha 3.20.1 - Multiple Cross-Site Scripting Cross-Site Request Forgery Vulnerabilities Exploit Title: Koha Open Source ILS - Multiple XSS and XSRF Vulnerabilities Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Securit...

Koha < 3.16.6, 3.18.x < 3.18.2 Multiple XSS Vulnerabilities - Active Check

Koha is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2014-9446

Multiple cross-site scripting XSS vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sortby parameter to the 1 opac parameter in opac-search.pl or 2 intranet parameter in catalogue/search.pl...