CVE-2017-12585

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12584

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...

CVE-2017-12586

The CVE-2017-12586 issue affects SLiMS 8 Akasia up to version 8.3.1. Affected component: admin/help.php URL parameter handling, where a directory traversal flaw allows arbitrary file reading. It can be exploited by remote authenticated librarian users. The connected sources confirm the vulnerabil...

CVE-2017-12584

Summary: CVE-2017-12584 affects SLiMS 8 Akasia (8.3.1 and earlier). The vulnerability stems from no CSRF mitigation and a flaw in admin/modules/system/app_user.php that allows changing a user’s password and profile via passwd1/passwd2 during a changecurrent=true operation without requiring the cu...

CVE-2017-12585

CVE-2017-12585 affects SLiMS 8 Akasia through 8.3.1. The vulnerability is an SQL injection in admin/AJAX_lookup_handler.php (parameters tableName and tableFields), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users. The exac...

CVE-2017-12586: Improper Limitation of a Pathname to a Restricted Directory

SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12585: Improper Neutralization of Special Elements used in an SQL Command

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAXlookuphandler.php tableName and tableFields parameters, admin/AJAXcheckid.php, and admin/AJAXvocabolarycontrol.php. It can be exploited by remote authenticated librarian users...

CVE-2017-12584: Cross-Site Request Forgery (CSRF)

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...

SLiMS 7 Cendana Cross-Site Scripting Vulnerability

SLiMS 7 Cendana is an open source, free library management system. A cross-site scripting vulnerability exists in the admin/modules component in SLiMS 7 Cendana on 2017-03-23 and earlier. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-7242

Multiple Cross-Site Scripting XSS were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkoutitem.php, bibliography/dlprint.php, bibliography/item.php, bibliography/itembarcodegenerator.php, bibliography/printedcard.php,...

CVE-2017-7242

Multiple Cross-Site Scripting XSS were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkoutitem.php, bibliography/dlprint.php, bibliography/item.php, bibliography/itembarcodegenerator.php, bibliography/printedcard.php,...

Cross site scripting

Multiple Cross-Site Scripting XSS were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkoutitem.php, bibliography/dlprint.php, bibliography/item.php, bibliography/itembarcodegenerator.php, bibliography/printedcard.php,...

CVE-2017-7242

CVE-2017-7242 is an XSS vulnerability in SLiMS 7 Cendana affecting multiple admin/modules components. The described flaws involve unsafely handling user-supplied input in the keywords parameter across several scripts (bibliography/checkout_item.php, bibliography/dl_print.php, bibliography/item.ph...

CVE-2017-7242

Multiple Cross-Site Scripting XSS were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkoutitem.php, bibliography/dlprint.php, bibliography/item.php, bibliography/itembarcodegenerator.php, bibliography/printedcard.php,...

CVE-2017-7242: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkoutitem.php, bibliography/dlprint.php, bibliography/item.php, bibliography/itembarcodegenerator.php, bibliography/printedcard.php,...

SLiMS 7 Cendana Cross-Site Scripting Vulnerability

SLiMS 7 Cendana is an open source, free library management system. A cross-site scripting vulnerability exists in versions of SLiMS 7 Cendana prior to 2017-03-16 that stems from the program failing to adequately filter user-submitted data. A remote attacker can exploit the vulnerability to execut...

Cross site scripting

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

CVE-2017-7202

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

CVE-2017-7202

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

CVE-2017-7202

SLiMS 7 Cendana before 2017-03-16 contains XSS in two detail templates due to insufficient filtration of user-supplied id. Specifically, the vulnerability involves slims7_cendana-master/template/default/detail_template.php and slims7_cendana-master/template/default-rtl/detail_template.php, enabli...