PT-2014-68: Multiple SQL Injection in InstantCMS

The specialists of the Positive Research center have detected multiple SQL Injection vulnerabilities in InstantCMS. SQL Injection in the cms.php script allows remote attackers to execute arbitrary SQL commands via a specially crafted request. How to fix Update your software up to the latest...

PT-2014-90: Cross-Site Scripting in ShopOS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in ShopOS. Reflected cross-site scripting in the account.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How ...

PT-2014-82: Multiple Local File Inclusion Vulnerabilities in ShopOS

The specialists of the Positive Research center have detected multiple Local File Inclusion vulnerabilities in ShopOS. Insufficient validation of user input in the \en\lang.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may resul...

PT-2014-85: Local File Inclusion in ShopOS

The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in ShopOS. Insufficient validation of user input in the 3.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may result in sensitive...

PT-2014-65: Multiple Cross-Site Scripting in InstantCMS

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in InstantCMS. Cross-site scripting in the spellchecker.php file allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's...

PT-2014-73: Two Cross-Site Scripting vulnerabilities in Jahia CMS

The specialists of the Positive Research center have detected two Cross-Site Scripting vulnerabilities in Jahia CMS. Two reflected cross-site scripting vulnerabilities in the ManageGroups.java script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a pag...

PT-2014-71: Cross-Site Scripting in Jahia CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Reflected cross-site scripting in the groupsearch.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browse...

PT-2014-69: Cross-Site Scripting in Jahia CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Reflected cross-site scripting in the manager.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. H...

PT-2014-70: Cross-Site Scripting in Jahia CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Reflected cross-site scripting in the usersearch.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser...

PT-2014-74: Cross-Site Scripting in Jahia CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Stored cross-site scripting in the ManageSiteLanguages.java script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user'...

PT-2013-75: Cross-Site Scripting in Nuxeo Platform

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Nuxeo Platform. Cross-site scripting in the login.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

PT-2014-78: Cross-site scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-site scripting vulnerability in Kasseler CMS. Insufficient validation of user input in the \function\init.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...

PT-2014-75: Cross-Site Scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the install.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

PT-2014-77: Local File Inclusion in Kasseler CMS

The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in Kasseler CMS. Insufficient validation of user input in the \search\index.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...

PT-2014-76: Cross-Site Scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the engine.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fi...

Invensys Wonderware Win-XML Exporter Improper Input Validation Vulnerability

Overview This advisory was originally posted to the US-CERT secure Portal library on March 08, 2013, and is now being released to the ICS-CERT Web page. This advisory provides mitigation details for a vulnerability that impacts the Invensys Wonderware Win-XML Exporter. Researchers Timur Yunusov,...

PT-2013-79: Relative path traversal in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected a Relative path traversal vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to traverse through the server’s file system based on the application’s Windo...

PT-2013-78: Buffer overflow in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected a Buffer overflow vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to perform remote code execution by sending specially crafted packets without...

PT-2013-90: Unauthorized Access in Emerson DeltaV

The specialists of the Positive Research center have detected an Unauthorized Access vulnerability in Emerson DeltaV. A Local attacker with user privileges can read configuration file to obtain sensitive information. User name and password for the DeltaVAdmin account are stored in plaintext. How ...

PT-2013-91: Hard-Coded Access Credentials in Emerson DeltaV

The specialists of the Positive Research center have detected a Hard-Coded Access Credentials vulnerability in Emerson DeltaV. An attacker can connect to the application using Telnet and run commands or change settings. How to fix Update your sofware up to the latest version Advisory status...