ocPoral CMS 8.x | Session Hijacking Vulnerability

OVERVIEW ocPoral CMS 8.x and lower versions are vulnerable to Session Hijacking flaw which could allow attackers to compromise administrator session. 2. PRODUCT DESCRIPTION ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful...

Banana Dance Wiki b2.2 Multiple Vulnerabilities

Exploit for php platform in category web applications BananaDance Wiki b2.2 - Multiple Web Vulnerabilities Banana Dance is an open-source PHP/MySQL-based program. It is designed to combine the simplicity of wiki-publishing software with the versatility of a CMS. The program also promotes...

iDev Rentals v1.0 Multiple Vulnerabilities

Exploit for php platform in category web applications iDev Rentals v1.0 - Multiple Web Vulnerabilities Introduction: ============= idev-Rentals is a PHP Script special software for your website allows you to create an apartment / housing / accommodation rentals listing directory. You and your...

Aoop CMS 0.3.6 Multiple Vulnerabilities

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ----------------------- Product: Aoop CMS Vendor URL: www.annonyme.de Type: Cross-site Scripting CWE-79, SQL-Injection CWE-89 Date found: 2012-04-07 Date published: 2012-08-24 CVSSv2 Score: 7,5 AV:N/AC:L/Au:N/C:P/I:P/A:...

aoop CMS 0.3.6 - Multiple Vulnerabilities

aoop CMS 0.3.6 - Multiple Vulnerabilities Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Aoop CMS Vendor URL: www.annonyme.de Type: Cross-site Scripting CWE-79, SQL-Injection CWE-89 Date found: 2012-04-07 Date published: 2012-08-24 CVSSv2...

[FOREGROUND SECURITY 2012-001] Lsoft ListServ v16 (WA revision R4241) SHOWTPL parameter Cross-SIte Scripting - XSS

============================================================ FOREGROUND SECURITY, SECURITY ADVISORY 2012-001 - Original release date: August 16, 2012 - Discovered by: Jose Carlos de Arriba Penetration Testing Team Lead at Foreground Security - Contact: jcarriba at foregroundsecurity dot com, dade...

CVE-2010-5080

The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HT...

CVE-2012-4581

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

CVE-2012-4581

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

Google Analytics v4.2.4 Wordpress - Web Vulnerabilities

Document Title: =============== Google Analytics v4.2.4 Wordpress - Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=692 Release Date: ============= 2012-08-22 Vulnerability Laboratory ID VL-ID: ==================================== 692...

NextGEN Gallery v1.9.5 Wordpress - Web Vulnerabilities

Document Title: =============== NextGEN Gallery v1.9.5 Wordpress - Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=693 Release Date: ============= 2012-08-22 Vulnerability Laboratory ID VL-ID: ==================================== 693...

AdRotate v3.7.3.5 Wordpress - Multiple Web Vulnerabilities

Document Title: =============== AdRotate v3.7.3.5 Wordpress - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=690 Release Date: ============= 2012-08-20 Vulnerability Laboratory ID VL-ID: ====================================...

ocPortal CMS 8.x Session Hijacking

OVERVIEW ocPoral CMS 8.x and lower versions are vulnerable to Session Hijacking flaw which could allow attackers to compromise administrator session. 2. PRODUCT DESCRIPTION ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful...

Social Engine 4.2.5 Cross Site Scripting

Title: ====== Social Engine v4.2.5 - Multiple Web Vulnerabilities Date: ===== 2012-07-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=672 VL-ID: ===== 672 Common Vulnerability Scoring System: ==================================== 3 Abstract: ========= A Laboratory...

Lsoft ListServ 16 Cross Site Scripting

============================================================ FOREGROUND SECURITY, SECURITY ADVISORY 2012-001 - Original release date: August 16, 2012 - Discovered by: Jose Carlos de Arriba Penetration Testing Team Lead at Foreground Security - Contact: jcarriba at foregroundsecurity dot com, dade...

ASTPP VoIP Billing (4cf207a) - Multiple Web Vulnerabilities

Document Title: =============== ASTPP VoIP Billing 4cf207a - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=687 Release Date: ============= 2012-08-16 Vulnerability Laboratory ID VL-ID: ==================================== 6...

ASTPP VoIP Billing (4cf207a) - Multiple Web Vulnerabilities

Document Title: =============== ASTPP VoIP Billing 4cf207a - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=687 Release Date: ============= 2012-08-16 Vulnerability Laboratory ID VL-ID: ==================================== 6...

Design/Logic Flaw

The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote attackers to obtain a logged-in session via unspecified vectors related to the "URL of a RSS feed of the user."...

Ossim SIEM v4.0 - Multiple Cross Site Vulnerabilities

Document Title: =============== Ossim SIEM v4.0 - Multiple Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=679 Release Date: ============= 2012-08-13 Vulnerability Laboratory ID VL-ID: ==================================== 679...