Elipse E3 Process Control Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified a process control vulnerability in the Elipse E3...

CVE-2015-2264

Multiple untrusted search path vulnerabilities in 1 EQATEC.Analytics.Monitor.Win32vc100.dll and 2 EQATEC.Analytics.Monitor.Win32vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse a csunsapi.dll, b swift.dll, c nfhwcrhk.dll, or...

Directory traversal

Multiple untrusted search path vulnerabilities in 1 EQATEC.Analytics.Monitor.Win32vc100.dll and 2 EQATEC.Analytics.Monitor.Win32vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse a csunsapi.dll, b swift.dll, c nfhwcrhk.dll, or...

CVE-2015-2264

CVE-2015-2264 involves untrusted search path vulnerabilities in Telerik Analytics Monitor Library (EQATEC.Analytics.Monitor.Win32_vc100.dll and Win32_vc100-x64.dll) used by Elipse E3. The root cause is loading Trojan horse DLLs (csunsapi.dll, swift.dll, nfhwcrhk.dll, or surewarehook.dll) from an ...

Telerik Analytics Monitor Library Search Path Vulnerability

Telerik Analytics Monitor Library is a library for third-party application analytics services to collect information about applications. A search path vulnerability in Telerik Analytics Monitor Library allows local attackers to exploit the vulnerability to execute in the context of an application...

Telerik Analytics Monitor Library allows DLL hijacking

Overview Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application...

Sitefinity Enterprise v7.2.53 - Persistent Vulnerability

Document Title: =============== Sitefinity Enterprise v7.2.53 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1369 Release Date: ============= 2015-01-06 Vulnerability Laboratory ID VL-ID: ====================================...

Sitefinity Enterprise 7.2.53 Script Insertion

Document Title: =============== Sitefinity Enterprise v7.2.53 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1369 Release Date: ============= 2015-01-06 Vulnerability Laboratory ID VL-ID: ====================================...

Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability

Document Title: =============== Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1369 Release Date: ============= 2015-01-06 Vulnerability Laboratory ID VL-ID: ===================================...

Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability

Document Title: =============== Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1369 Release Date: ============= 2015-01-06 Vulnerability Laboratory ID VL-ID: ===================================...

Telerik UI for ASP.NET AJAX Q3 Absolute Path Traversal Vulnerability

Telerik UI for ASP.NET AJAX Q3 is the development version of the famous ASP.NET commercial control. An absolute path traversal vulnerability in Telerik UI for ASP.NET AJAX Q3 prior to 2012 SP2 allows remote attackers to execute arbitrary code by writing an arbitrary file to the full pathname of t...

CVE-2014-2217

Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value...

Path traversal

Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value...

CVE-2014-2217

CVE-2014-2217 describes an absolute path traversal in the RadAsyncUpload control of Telerik UI for ASP.NET AJAX, affecting versions before Q3 2012 SP2. An attacker can supply a full pathname in the UploadID metadata to write arbitrary files on the server and potentially execute arbitrary code. Th...

CVE-2014-2217

Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value...

PT-2014-4562 · Telerik · Telerik Ui For Asp.Net Ajax

Name of the Vulnerable Software and Affected Versions: Telerik UI for ASP.NET AJAX versions prior to Q3 2012 SP2 Description: The issue allows remote attackers to write to arbitrary files and consequently execute arbitrary code via a full pathname in the UploadID metadata value in the...

CVE-2014-4958: Stored Attribute-Based Cross-Site Scripting (XSS) Vulnerability in Telerik UI for ASP.NET AJAX RadEditor Control

All versions of the popular UI for ASP.NET AJAX RadEditor Control product by Telerik may be affected by a high-risk stored attribute-based cross-site scripting XSS vulnerability that is assigned CVE-2014-4958. This WYSIWYG rich text editor is “...what Microsoft chose to use in MSDN, CodePlex,...

Web Editor Vulnerable To XSS Attacks

All versions of an HTML editor used in several Microsoft technologies, including ASP.NET, suffer from a high-risk cross-site scripting XSS vulnerability that could allow an attacker to inject malicious script and glean private information. The problem exists in all versions of RadEditor, a WYSIWY...

CVE-2014-4958

Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...

Cross site scripting

Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...