Sql injection

Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 reqclass parameter to editrequestenduser.asp; the 2 sysrequestid parameter to editrequestuser.asp; the 3 sysrequestid parameter to enduseractions.asp; the 4 sysrequest...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 syssolutionid, 2 sysrequesttypeid, 3 sysproblemdesc, 4 syssolutiondesc, 5 sysproblemsummary, 6 usrActiontesting, 7 usrEscalation, or 8...

Design/Logic Flaw

selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sysassetid request, which is not properly handled during construction of an error page...

Code injection

Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified 1 loggedinenduser, 2 loggedinendusername, 3 loggedinuserusergroup, 4 loggedinuser, or 5 loggedinusername cookie...

CVE-2012-4977

Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network...

CVE-2012-4975

CVE-2012-4975 affects Layton Helpbox 4.4.0. An authorization bypass exists on editrequestuser.asp: by changing the sys_request_id parameter, a remote authenticated attacker can access and modify other users’ support-ticket data, effectively logging in as another user and altering data. The descri...

CVE-2012-4976

selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sysassetid request, which is not properly handled during construction of an error page...

CVE-2012-4971

CVE-2012-4971 describes multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0. The affected components include various ASP pages and parameters such as editrequestenduser.asp (reqclass), editrequestuser.asp (sys_request_id), enduseractions.asp (sys_request_id), enduserreopenrequeststatus...

CVE-2012-4971

Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 reqclass parameter to editrequestenduser.asp; the 2 sysrequestid parameter to editrequestuser.asp; the 3 sysrequestid parameter to enduseractions.asp; the 4 sysrequest...

CVE-2012-4974

Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified 1 loggedinenduser, 2 loggedinendusername, 3 loggedinuserusergroup, 4 loggedinuser, or 5 loggedinusername cookie...

CVE-2012-4977

CVE-2012-4977 affects Layton Helpbox 4.4.0. The vulnerability allows remote attackers to obtain cleartext credentials from the login page by sniffing unencrypted network traffic. Root cause is unencrypted login handling. Impact is exposure of credentials during authentication. No remediation deta...

CVE-2012-4975

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

CVE-2012-4972

Multiple cross-site scripting XSS vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 syssolutionid, 2 sysrequesttypeid, 3 sysproblemdesc, 4 syssolutiondesc, 5 sysproblemsummary, 6 usrActiontesting, 7 usrEscalation, or 8...

CVE-2012-4976

Layton Helpbox 4.4.0 is affected by CVE-2012-4976. The vulnerable page is selectawasset.asp, where the querystring element=sys_asset_id is not properly sanitized during error-page construction, leading to disclosure of ODBC database credentials in cleartext. This credential exposure can allow an ...

CVE-2012-4974

The CVE-2012-4974 entry concerns Layton Helpbox 4.4.0. Affected component: login/session handling via several cookies (loggedinenduser, loggedinendusername, loggedinuserusergroup, loggedinuser, loggedinusername). Root cause: an attacker with authenticated access can modify these cookies to alter ...

CVE-2012-4972

Layton Helpbox 4.4.0 is affected by cross-site scripting (XSS) vulnerabilities. Exploitable via writesolutionuser.asp (parameters: sys_solution_id, sys_requesttype_id, sys_problem_desc, sys_solution_desc, sys_problemsummary, usr_Action_testing, usr_Escalation, usr_Additional_Resources) and delete...

CVE-2012-4974: Undefined Security Weakness

Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified 1 loggedinenduser, 2 loggedinendusername, 3 loggedinuserusergroup, 4 loggedinuser, or 5 loggedinusername cookie...

CVE-2012-4977: Undefined Security Weakness

Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network...

CVE-2012-4972: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 syssolutionid, 2 sysrequesttypeid, 3 sysproblemdesc, 4 syssolutiondesc, 5 sysproblemsummary, 6 usrActiontesting, 7 usrEscalation, or 8...

CVE-2012-4976: Exposure of Sensitive Information to an Unauthorized Actor

selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sysassetid request, which is not properly handled during construction of an error page...