CVE-2015-2952

The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than...

CVE-2015-2953

CVE-2015-2953 affects Igreks MilkyStep Light 0.94 and earlier and MilkyStep Professional 1.82 and earlier. The user-information management functionality allows remote attackers to bypass access restrictions and read files via unspecified vectors. This vulnerability is corroborated by CNVD/NVD ent...

CVE-2015-2958

The CVE-2015-2958 entry concerns Igreks MilkyStep Light (0.94 and earlier) and MilkyStep Professional (1.82 and earlier), where remote attackers could bypass access restrictions and modify administrator credentials via unspecified vectors. This vulnerability is distinct from CVE-2015-2952 and CVE...

CVE-2015-2958

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953...

CVE-2015-2957

Cross-site scripting XSS vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2956

SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-2955

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users...

Sql injection

SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-2957

Cross-site scripting XSS vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2955

CVE-2015-2955 affects Igreks MilkyStep, specifically MilkyStep Light 0.94 and earlier and MilkyStep Professional 1.82 and earlier. The root cause is an OS command injection vulnerability (CWE-78) in a CGI component used for email newsletter distribution. This allows a remote attacker to execute a...

CVE-2015-2957

MilkyStep XSS (CVE-2015-2957) affects Igreks MilkyStep Light 0.94 and earlier and MilkyStep Professional 1.82 and earlier. The vulnerability is a cross-site scripting flaw (CWE-79) in the MilkyStep CGI for email newsletter management, arising from improper handling of input/output that allows rem...

CVE-2015-2954

The CVE concerns Igreks MilkyStep products vulnerable to Cross-Site Request Forgery (CSRF, CWE-352). Affected components are MilkyStep Light version 0.94 and earlier, MilkyStep Professional version 1.82 and earlier, and related OEM/builds. If a logged-in user views a malicious page, an attacker c...

CVE-2015-2954

Cross-site request forgery CSRF vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-2956

MilkyStep by Igreks MilkyStep Light v0.94 and earlier and MilkyStep Professional v1.82 and earlier contain a SQL injection (CWE-89) vulnerability that enables remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products include MilkyStep Light Ver0.94 and earlier ...

CVE-2015-2955

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2015-2956

SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

MilkyStep fails to restrict access permissions

Overview MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions against the management function for user information CWE-284. Note that this vulnerability is different from JVN16409640 or JVN74280258. Kusano Kazuhik...