Multiple Vulnerabilities in A Really Simple Chat (ARSC)

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in A Really Simple Chat ARSC which could be exploited to perform cross-site scripting, cross-site request forgery and SQL injection attacks. 1 Cross-site scripting XSS vulnerability in A Really Simple Chat ARSC:...

HTB22971: XSRF (CSRF) in PHPDug

Vulnerability ID: HTB22971 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpdug.html Product: PHPDug Vendor: Kubelabs.com http://www.kubelabs.com/ Vulnerable Version: 2.0.0 and probably prior versions Vendor Notification: 21 April 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Ri...

HTB22973: XSS in AJAX Calendar

Vulnerability ID: HTB22973 Reference: http://www.htbridge.ch/advisory/xssinajaxcalendar.html Product: AJAX Calendar Vendor: OpenCrypt http://www.opencrypt.com Vulnerable Version: 1.0 Vendor Notification: 21 April 2011 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Risk level...

Ajax Calendar 1.0 Cross Site Scripting

Vulnerability ID: HTB22973 Reference: http://www.htbridge.ch/advisory/xssinajaxcalendar.html Product: AJAX Calendar Vendor: OpenCrypt http://www.opencrypt.com Vulnerable Version: 1.0 Vendor Notification: 21 April 2011 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Risk level...

sipdroid 2.2 - SIP INVITE Response User Enumeration

source: https://www.securityfocus.com/bid/47710/info sipdroid is prone to a user-enumeration weakness. An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks. sipdroid 1.6.1, 2.0.1, and 2.2 running on Android 2.1 are vulnerable; other versions may als...

SelectaPix Image Gallery 1.4.1 Cross Site Request Forgery

Vulnerability ID: HTB22963 Reference: http://www.htbridge.ch/advisory/csrfcrosssiterequestforgeryinselectapiximagegallery.html Product: SelectaPix Image Gallery Vendor: http://www.outofthetrees.co.uk/ http://www.outofthetrees.co.uk/ Vulnerable Version: 1.4.1 Vendor Notification: 19 April 2011...

[Onapsis Security Advisory 2011-003] SAP WebAS ITS Mobile Start Service Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2011-003: SAP WebAS ITS Mobile Start Service Multiple Vulnerabilities This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain...

ZDI-11-151: HP Data Protector Backup Client Service bm Message Processing Remote Code Execution Vulnerability

ZDI-11-151: HP Data Protector Backup Client Service bm Message Processing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-151 April 29, 2011 -- CVE ID: CVE-2011-1735 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard -- Affected...

xMatters AlarmPoint APClient 3.2.0 Heap Buffer Overflow

Information -------------------- Name : Heap Buffer Overflow in xMatters AlarmPoint APClient Version: APClient 3.2.0 native Software : xMatters AlarmPoint Vendor Homepage : http://www.xmatters.com Vulnerability Type : Heap Buffer Overflow Md5: 283d98063323f35deb7afbd1db93d859 APClient.bin Severit...

phpGraphy 0.9.13b - Multiple Vulnerabilities

===================================== Vulnerability ID: HTB22959 Reference: http://www.htbridge.ch/advisory/csrfcrosssiterequestforgeryinphpgraphy.html Product: phpGraphy Vendor: http://phpgraphy.sourceforge.net/ http://phpgraphy.sourceforge.net/ Vulnerable Version: 0.9.13b Vendor Notification: 1...

Daily Maui Photo Widget WordPress Plugin 0.2 Cross Site Scripting

Vulnerability ID: HTB22960 Reference: http://www.htbridge.ch/advisory/xssindailymauiphotowidgetwordpressplugin.html Product: Daily Maui Photo Widget wordpress plugin Vendor: Kris Nelson http://www.webnelly.com/ Vulnerable Version: 0.2 Vendor Notification: 14 April 2011 Vulnerability Type: XSS Cro...

xMatters AlarmPoint Java Web Server API 3.2.1 Cross Site Scripting

Information -------------------- Name : XSS Persistent vulnerability in xMatters AlarmPoint Java Web Server API Software : xMatters AlarmPoint Vendor Homepage : http://www.xmatters.com Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Juan Sacco Description ------------------...

Max's PHP Photo Album 2008-04-01 Cross Site Scripting

Vulnerability ID: HTB22953 Reference: http://www.htbridge.ch/advisory/xssinmaxsphpphotoalbum.html Product: Max's PHP Photo Album Vendor: http://www.phpf1.com http://www.phpf1.com Vulnerable Version: 2008-04-01 Vendor Notification: 12 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

HTB22956: XSS vulnerabilities in phpList

Vulnerability ID: HTB22956 Reference: http://www.htbridge.ch/advisory/xssvulnerabilitiesinphplist.html Product: phpList Vendor: Tincan Ltd http://www.phplist.com/ Vulnerable Version: 2.10.13 and probably prior versions Vendor Notification: 12 April 2011 Vulnerability Type: XSS Risk level: Medium...

Multiple Vulnerabilities in poMMo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in poMMo which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in poMMo 1.1 The vulnerability exists due to input sanitation erro...

Cross-site Scripting (XSS) Vulnerabilities in Calendarix

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Calendarix which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Calendarix 1.1 The vulnerability exists due to input sanitation errors in URL in...

4images 1.7.9 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: 4images Vendor: http://www.4homepages.de/ http://www.4homepages.de/ Vulnerable Version: 1.7.9 Vendor Notification: 07 April 2011 Vulnerability Type: SQL Injection Status: Fixed by Vendor Risk level: Medium Credit: High-Tech Bridge SA...

The Oak Ridge National Laboratory Hacked !

A top United States federal lab was the victim of a "silent" cyberattack earlier this month, news outlets are reporting The Oak Ridge National Laboratory in Tennessee was the victim, according to Nextgov.com. The lab is an energy department laboratory that studies nuclear fusion, supercomputing,...

4images 1.7.9 SQL Injection / Path Disclosure

================================ Vulnerability ID: HTB22950 Reference: http://www.htbridge.ch/advisory/sqlinjectionin4images.html Product: 4images Vendor: http://www.4homepages.de/ http://www.4homepages.de/ Vulnerable Version: 1.7.9 Vendor Notification: 07 April 2011 Vulnerability Type: SQL...

WordPress Plugin Ajax Category Dropdown 0.1.5 - Multiple Vulnerabilities

============================= Vulnerability ID: HTB22946 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectioninajaxcategorydropdownwordpressplugin.html Product: Ajax Category Dropdown wordpress plugin Vendor: http://www.dyasonhat.com/ http://www.dyasonhat.com/ Vulnerable Version: 0.1.5...