Zurmo CRM 2.8.5 Cross Site Scripting

Zurmo CRM 2.8.5 Multiple Reflected Cross-Site Scripting Vulnerabilities Vendor: Zurmo Inc. Product web page: http://www.zurmo.org Affected version: 2.8.5 Summary: Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. Desc: Zurmo CRM suffers...

Twitter Launches Digits – A Password Free Login Service For App Developers

There’s a good news for app developers. On Wednesday at Twitter’s first annual developer conference Flight, the company announced a new tool for developers which will allow users to log-in to mobile applications using their phone numbers rather than a traditional username and password combination...

insight.ly Cross Site Scripting

Author:Provensec Vendor: insight.ly Vulnerability Type:persistent xss Discription: Integrated online customer relationship management CRM and project management makes sure you are on top of critical business processes. Exploit: 1 Goto add contacts 2 Fill the work address field with xss payload...

USN-2347-1: Django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

Crlf injection

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

Zurmo CRM - Persistent XSS Vulnerability

Exploit for php platform in category web applications Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS...

Zurmo CRM - Persistent Cross-Site Scripting

Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS Stored URL: zurmo.com Discovered by: Provensec Websit...

Zend Server Java Bridge Arbitrary Java Code Execution

No description provided by source. $Id: zendjavabridge.rb 12242 2011-04-05 01:08:07Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...

Security vulnerability concepts and classification-vulnerability warning-the black bar safety net

Author: Wang column army This is a security vulnerability related to the science, introducing a security vulnerability concept, vulnerability in several dimensions of classification and examples show. Security vulnerability and related concepts This section describes what is a security...

Released Emails Show 'Google in a Relationship With NSA'

Edward Snowden's leaks last year questioned the integrity of several big and reputed companies such as Apple, Google and Microsoft that were found in relation with the NSA in its surveillance programs. Thereafter they maintained distance with the Agency and claimed to be unaware of such governmen...

Puppet Dashboard Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Dashboard install on the remote host is later than version 1.0 but prior to 1.2.5. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is not...

Puppet Enterprise Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is later than version 1.0 but prior to 1.2.5 / 2.0.1. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is n...

CUPS < 1.7.2 is_path_absolute Function XSS

According to its banner, the version of CUPS installed on the remote host is prior to version 1.7.2. It is, therefore, affected by a cross-site scripting vulnerability. A flaw exists with the ispathabsolute function within the scheduler/client.cscript. This could allow a context-dependent attacke...

Symantec Messaging Gateway 10.x < 10.5.2 Management Console XSS (SYM14-006)

According to its self-reported version number, the version of Symantec Messaging Gateway running on the remote host is 10.x less than 10.5.2, and is therefore affected by a cross-site scripting vulnerability. A cross-site scripting flaw exists in the...

kitForm CRM Extension 0.43 (sorter.php, sorter_value param) - SQL Injection

Exploit for php platform in category web applications -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Happy easter.. Product: phpManufaktur / kitForm Version: query$SQL; 3. Exploit 1. import httplib2, socks, urllib 2. 3. Change these values 4. t...

kitForm CRM Extension 0.43 - 'sorter.ph?sorter_value' SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Happy easter.. Product: phpManufaktur / kitForm Version: query$SQL; 3. Exploit 1. import httplib2, socks, urllib 2. 3. Change these values 4. target = "http://fbi.gov" 5. SQLi = "or 1=1 " 6. torhttpproxy = 8118 7. 8. httplib2.debuglevel=4 9. 10...

Reflective XSS Vulnerability in twitter-bootstrap-rails

The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting XSS attack. This flaw exists because the bootstrapflash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent...

RSA Conference 2014 Art Coviello RSA keynote

SAN FRANCISCO – RSA Security executive chairman Art Coviello today at RSA Conference 2014 made his first public comments about the security company’s relationship with the National Security Agency, painting the landmark firm as a victim of the spy agency’s blurring of the lines between its...

CVE-2014-0737

Cisco CVE-2014-0737 affects the Cisco Unified IP Phone 7960G (9.2(1) and earlier). The root issue is insufficient CTL (Certificate Trust List) validation, allowing remote attackers to bypass authentication and inject a crafted CTL file to change trust relationships, enabling control over trusted ...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...