WordPress Ad Manager Plugin <=1.1.2 - Open Redirect

This vulnerability is in the track-click.php. It allows the attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "out" parameter. Solution Update the plugin...

CVE-2014-4872

BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to 1 FileStorageService or 2 ConfigurationService...

CVE-2014-4873

SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data...

CVE-2014-4874

BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page...

Design/Logic Flaw

BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to 1 FileStorageService or 2 ConfigurationService...

Code injection

BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page...

CVE-2014-4872

BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to 1 FileStorageService or 2 ConfigurationService...

Sql injection

SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data...

CVE-2014-4872

BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to 1 FileStorageService or 2 ConfigurationService...

CVE-2014-4873

SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data...

CVE-2014-4874

BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page...

CVE-2014-4872

CVE-2014-4872 concerns BMC Track-It! 11.3.0.355 where an unauthenticated remote interface on TCP port 9010 allows a remote attacker to invoke .NET Remoting services (FileStorageService or ConfigurationService), enabling upload of arbitrary files and potential code execution or access to sensitive...

CVE-2014-4873

CVE-2014-4873 affects BMC Track-It! 11.3.0.355. The vulnerability is an SQL injection in TrackItWeb/Grid/GetData that allows a remote authenticated user to execute arbitrary SQL commands via crafted POST data. Multiple sources corroborate the issue and indicate hotfixes are available from the ven...

CVE-2014-4874

CVE-2014-4874 affects BMC Track-It! 11.3.0.355. An authenticated remote attacker can read arbitrary files via TrackItWeb/Attachment/Open (arbitrary file download). No vendor fix is stated in the provided docs; remediation guidance from the consortium of sources includes blocking network access to...

PT-2014-6183 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 11.3.0.355 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via crafted POST data, specifically targeting the TrackItWeb/Grid/GetData endpoint. Recommendations: For version...

PT-2014-6184 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 11.3.0.355 Description: The issue allows remote authenticated users to read arbitrary files by visiting the "TrackItWeb/Attachment" page. Recommendations: For version 11.3.0.355, consider restricting access to the...

CVE-2014-4874: Exposure of Sensitive Information to an Unauthorized Actor

BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page...

CVE-2014-4872: Missing Authentication for Critical Function

BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to 1 FileStorageService or 2 ConfigurationService...

BMC Track-It! - Multiple Vulnerabilities

No description provided by source. Multiple critical vulnerabilities in BMC Track-It! Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= The application exposes several .NET remoting services o...

CVE-2014-4873: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data...