CVE-2015-2956: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-2958: Undefined Security Weakness

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953...

CVE-2015-2953: Undefined Security Weakness

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958...

CVE-2015-2955: Improper Neutralization of Special Elements used in an OS Command

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2015-6006

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953...

PT-2015-6001

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958...

CVE-2015-2952: Improper Access Control

The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than...

PT-2015-6004

Name of the Vulnerable Software and Affected Versions Igreks MilkyStep Light versions 0.94 and earlier Igreks MilkyStep Professional versions 1.82 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For Igreks MilkyStep Light versions 0.94...

PT-2015-6005

Name of the Vulnerable Software and Affected Versions Igreks MilkyStep Light versions 0.94 and earlier Igreks MilkyStep Professional versions 1.82 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-6003

Name of the Vulnerable Software and Affected Versions Igreks MilkyStep Light versions 0.94 and earlier Igreks MilkyStep Professional versions 1.82 and earlier Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For Igreks MilkyStep Light versions 0.94 a...

PT-2015-6002

Name of the Vulnerable Software and Affected Versions Igreks MilkyStep Light versions 0.94 and earlier Igreks MilkyStep Professional versions 1.82 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users. This can be...

CVE-2015-2957: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2954: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users...

MilkyStep fails to restrict access permissions

Overview MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions against the management function for user information CWE-284. Note that this vulnerability is different from JVN16409640 or JVN74280258. Kusano Kazuhik...

JVN#19732015: MilkyStep fails to restrict access permissions

MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions against the management function for user information CWE-284. Impact A non-administrative user may be able to change administrative user credentials. Solution...

Multiple Igreks MilkyStep Products Cross-Site Scripting Vulnerabilities

Igreks MilkyStep is a CGI for pushing magazines through the email system. A cross-site scripting vulnerability exists in multiple Igreks MilkyStep products, allowing remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Multiple Igreks MilkyStep Product Security Bypass Vulnerabilities

Igreks MilkyStep is a CGI for pushing magazines through the email system. A security bypass vulnerability exists in multiple Igreks MilkyStep products, which allows remote attackers to bypass security restrictions and perform unauthorized operations...

MilkyStep fails to restrict access permissions

Overview MilkyStep provided by Igreks Inc. fails to restrict access permissions. Note that this vulnerability is different from JVN16409640. MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions CWE-264. Kusano...

MilkyStep vulnerable to cross-site scripting

Overview MilkyStep provided by Igreks Inc. contains a cross-site scripting vulnerability. MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep contains a cross-site scripting vulnerability CWE-79. Kusano Kazuhiko reported this vulnerability to IPA...

MilkyStep vulnerable to SQL injection

Overview MilkyStep provided by Igreks Inc. contains a SQL injection vulnerability. MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep contains a SQL injection vulnerability CWE-89. Kusano Kazuhiko reported this vulnerability to IPA. JPCERT/CC...