DEBIAN-CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4567

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4568

Multiple cross-site request forgery CSRF vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4569

CVE-2012-4569 affects LetoDMS (formerly MyDMS) before 3.3.9. The vulnerability is in out/out.UsrMgr.php and permits remote XSS via unspecified vectors, allowing injection of arbitrary web script/HTML. Affected software/function: LetoDMS web interface; vulnerable component/file: out/out.UsrMgr.php...

CVE-2012-4567

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

CVE-2012-4570

Summary: CVE-2012-4570 affects LetoDMS (formerly MyDMS) up to version 3.3.7, due to an SQL injection in LetoDMS_Core/Core/inc.ClassDMS.php that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. What’s affected: LetoDMS (PHP+MySQL) deployments prior to 3.3.8. Root ...

CVE-2012-4568

The vulnerability CVE-2012-4568 affects LetoDMS (formerly MyDMS) prior to version 3.3.8. Multiple cross-site request forgery (CSRF) flaws allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The root cause is CSRF in the web application’s handling of aut...

CVE-2012-4567

LetoDMS (formerly MyDMS) before 3.3.8 contains multiple XSS vulnerabilities reachable via parameters in inc/inc.ClassUI.php and out/out.DocumentNotify.php. The issue, confirmed across CVE-2012-4567 entries, allows remote attackers to inject arbitrary scripts/HTML (no exploit details provided). Af...

CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4570

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4570: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4567: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

CVE-2012-4569: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4568: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Directory traversal

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2278

SeedDMS (formerly LetoDMS/MyDMS) before 4.3.4 has an unrestricted file upload in op/op.AddFile2.php. An attacker can specify an executable extension via partitionIndex and, using CVE-2014-2279’s path traversal in fileId, upload and later access the file to gain remote code execution. The issue is...