CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

DEBIAN-CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4568

Multiple cross-site request forgery CSRF vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4567

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

CVE-2012-4570

Summary: CVE-2012-4570 affects LetoDMS (formerly MyDMS) up to version 3.3.7, due to an SQL injection in LetoDMS_Core/Core/inc.ClassDMS.php that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. What’s affected: LetoDMS (PHP+MySQL) deployments prior to 3.3.8. Root ...

CVE-2012-4568

Multiple cross-site request forgery CSRF vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4569

CVE-2012-4569 affects LetoDMS (formerly MyDMS) before 3.3.9. The vulnerability is in out/out.UsrMgr.php and permits remote XSS via unspecified vectors, allowing injection of arbitrary web script/HTML. Affected software/function: LetoDMS web interface; vulnerable component/file: out/out.UsrMgr.php...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4567

LetoDMS (formerly MyDMS) before 3.3.8 contains multiple XSS vulnerabilities reachable via parameters in inc/inc.ClassUI.php and out/out.DocumentNotify.php. The issue, confirmed across CVE-2012-4567 entries, allows remote attackers to inject arbitrary scripts/HTML (no exploit details provided). Af...

CVE-2012-4568

The vulnerability CVE-2012-4568 affects LetoDMS (formerly MyDMS) prior to version 3.3.8. Multiple cross-site request forgery (CSRF) flaws allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The root cause is CSRF in the web application’s handling of aut...

Directory traversal

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2278

SeedDMS (formerly LetoDMS/MyDMS) before 4.3.4 has an unrestricted file upload in op/op.AddFile2.php. An attacker can specify an executable extension via partitionIndex and, using CVE-2014-2279’s path traversal in fileId, upload and later access the file to gain remote code execution. The issue is...

letodms 3.3.6 - Multiple Vulnerabilities

No description provided by source. Exploit Title: LetoDMS 3.3.6 Multiple Reflected/Stored XSS & Password Change CSRF Vulnerability Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.letodms.com/ Software Link:...

LetoDMS 1.4.x 'lang' Parameter Local File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37828/info LetoDMS formerly known as MyDMS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

CVE-2014-2280

SeedDMS (formerly LetoDMS/MyDMS) before version 4.3.4 is affected by a reflected XSS in the search feature. The vulnerability arises from the query parameter used by the search, allowing attackers to inject arbitrary scripts/HTML that are returned without proper validation or sanitization. Public...

LetoDMS 3.3.6 XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: LetoDMS 3.3.6 Multiple Reflected/Stored XSS & Password Change CSRF Vulnerability Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.letodms.com/ Software Link:...

LetoDMS 3.3.6 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: LetoDMS 3.3.6 Multiple Reflected/Stored XSS & Password Change CSRF Vulnerability Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.letodms.com/ Software Link: http://sourceforge.net/projects/mydms/files/LetoDMS/LetoDMS-3.3.6/ Version: 3.3.6 Gr33Tz:...

letodms 3.3.6 - Multiple Vulnerabilities

letodms 3.3.6 - Multiple Vulnerabilities Exploit Title: LetoDMS 3.3.6 Multiple Reflected/Stored XSS & Password Change CSRF Vulnerability Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.letodms.com/ Software Link:...