Habari Blog - Multiple Vulnerabilities

Vulnerability ID: HTB22732 Reference: http://www.htbridge.ch/advisory/pathdisclosureinhabari.html Product: Habari Vendor: Habari http://habariproject.org/en/ Vulnerable Version: 0.6.5 Vendor Notification: 02 December 2010 Vulnerability Type: Path disclosure Status: Fixed by Vendor Risk level: Low...

html-edit CMS - Multiple Vulnerabilities

Vulnerability ID: HTB22734 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhtmleditcms.html Product: HTML-EDIT CMS Vendor: html-edit web services http://www.html-edit.org/ Vulnerable Version: 3.1.8 Vendor Notification: 02 December 2010 Vulnerability Type: SQL Injection Status: Fixed by...

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

According to its version number, the installation of WordPress is prior to 3.0.3. It is, therefore, affected by a security bypass vulnerability. Certain access control restrictions are not properly enforced, which could allow a remote, authenticated user to perform unauthorized actions such as...

Symantec IM Manager rdpageimlogic.aspx Multiple SQL Injections (CVE-2010-0112)

Symantec IM Manager is a software-based proxy to secure, manage, and log IM messages for enterprise and public IM protocols. It provides real-time threat protection against IM viruses, worms, and other types of attacks delivered through IM messages. Symantec IM Manager allows the definition of...

Path disclosure in BIGACE Web CMS

Vulnerability ID: HTB22690 Reference: http://www.htbridge.ch/advisory/pathdisclosureinbigacewebcms.html Product: BIGACE Web CMS Vendor: Kevin Papst http://www.bigace.de/ Vulnerable Version: 2.7.3 Vendor Notification: 02 November 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor...

Local file view in Etomite

Vulnerability ID: HTB22712 Reference: http://www.htbridge.ch/advisory/localfileviewinetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: Status: Not Fixed, Vendor Alerted, Awaiting...

Etomite 1.1 SQL,XSS,and file include vulnerabilities and fixes-vulnerability warning-the black bar safety net

Due to thevulnerabilityexists in“/index.php”the script has not been filtered will provide a search variable input. The attacker can modify the application the SQL query to the database, execute arbitrary queries of the database, compromise the application, access or modify sensitive data, or use ...

Etomite 1.1 Multiple Vulnerabilities

Exploit for php platform in category web applications ==================================== Etomite 1.1 Multiple Vulnerabilities ==================================== Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 20...

DynPG 4.2.0 Local File Inclusion / Path Disclosure / SQL Injection

Vulnerability ID: HTB22703 Reference: http://www.htbridge.ch/advisory/lfiindynpg.html Product: DynPG Vendor: dynpg.org http://www.dynpg.org/ Vulnerable Version: 4.2.0 Vendor Notification: 16 November 2010 Vulnerability Type: Local File Inclusion Status: Fixed by Vendor Risk level: Medium Credit:...

Enano CMS 1.1.7pl1 Path Disclosure / SQL Injection

Vulnerability ID: HTB22709 Reference: http://www.htbridge.ch/advisory/sqlinjectioninenanocms.html Product: Enano CMS Vendor: enanocms.org http://enanocms.org/ Vulnerable Version: 1.1.7pl1 Vendor Notification: 16 November 2010 Vulnerability Type: SQL Injection Status: Fixed by Vendor Risk level:...

Path disclosure in CLANSPHERE

Vulnerability ID: HTB22692 Reference: http://www.htbridge.ch/advisory/pathdisclosureinclansphere.html Product: CLANSPHERE Vendor: csphere.eu http://www.csphere.eu/ Vulnerable Version: 2010.0 Final Vendor Notification: 02 November 2010 Vulnerability Type: Path disclosure Status: Fixed by Vendor Ri...

Path disclosure in eoCMS

Vulnerability ID: HTB22674 Reference: http://www.htbridge.ch/advisory/pathdisclosureineocms.html Product: eoCMS Vendor: eocms.com http://eocms.com Vulnerable Version: 0.9.04 Vendor Notification: 21 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

Secretary <= 1.2 CSRF Remote User Settings Change

Exploit for php platform in category web applications ================================================= Secretary Date: 3/11/2010 Site: http://www.giudinvx.altervista.org/ -------------------------------------------------------- Application Info: THE SECRETARY A portfolio management system for...

MyBB v1.6 Full Path Disclosure Vulnerability

Exploit for php platform in category web applications ============================================ MyBB v1.6 Full Path Disclosure Vulnerability ============================================ Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB...

MyBB 1.6 - Full Path Disclosure

MyBB 1.6 - Full Path Disclosure Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor...

Mandriva Linux Security Advisory : pidgin (MDVSA-2010:208)

A security vulnerability has been identified and fixed in pidgin : It has been discovered that eight denial of service conditions exist in libpurple all due to insufficient validation of the return value from purplebase64decode. Invalid or malformed data received in place of a valid base64-encode...

Tribiq CMS 5.2.5 Path Disclosure

Vulnerability ID: HTB22640 Reference: http://www.htbridge.ch/advisory/pathdisclosureintribiqcms.html Product: Tribiq CMS Vendor: Tribiq http://tribiq.com/ Vulnerable Version: 5.2.5 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: Path disclosure Status: Fixed b...

Code injection

Unspecified vulnerability in the 1 PeopleSoft Enterprise FMS, 2 SCM, 3 EPM, 4 CRM, and 5 Campus Solutions components in Oracle PeopleSoft and JDEdwards Suite 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2010-3527

Unspecified vulnerability in the PeopleSoft Enterprise FMS - AM component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle 38, 9.0 Bundle 31, and 9.1 Bundle 6 allows remote authenticated users to affect integrity and availability via unknown vectors...

IISWorks FileMan Remote User Database Disclosure

Exploit Title: IISWorks FileMan fileman.mdb Remote User Database Disclosure Disclosure Date: July 5, 2005 Author: Known Vulnerability Software Link: http://www.scriptdungeon.com/scripts/asp/FileManASP.rar Version: OSVDB: 17824 Security Tracker ID: 1014383 Found exploited in the wild by: Joey Furr...