Cisco WebEx Business Suite Site Access Control Bypass Vulnerability

A vulnerability in the site access control implementation of Cisco WebEx Business Suite could allow an authenticated, remote attacker to inject content from the attacker-controlled WebEx site into another WebEx site. The vulnerability is due to insufficient validation of user-supplied input. An...

Cisco WebEx Multiple Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in Cisco WebEx Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by convincing a user ...

Dynamic Biz Website Builder (QuickWeb) 1.0 - appsnews-eventsnewdetail.asp?id SQL Injection

Dynamic Biz Website Builder QuickWeb 1.0 - appsnews-eventsnewdetail.asp?id SQL Injection source: https://www.securityfocus.com/bid/64371/info EtoShop Dynamic Biz Website Builder QuickWeb is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied inp...

espcms Command Execution Vulnerability可getshell（鸡肋）

简要描述： RT 详细说明： 在后台getshell，略鸡肋 在/datacache/command.php文件 $CONFIG=Array //ICP备案 'icpbeian'='', //网站状态 'isclose'=0, //管理员Email 'adminemail'='[email protected]', //网站网址 'domain'='http://localhost/espcms/', //日志记录 'islog'=1, ………… 后台修改网站系统设置后可将代码写入command.php中 访问command.php并传参...

eduTrac - showmask Directory Traversal

eduTrac - showmask Directory Traversal source: https://www.securityfocus.com/bid/64255/info eduTrac is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. A remote attacker could exploit the vulnerability using directory-traversal characters '.....

Enorth Webpublisher CMS - thisday SQL Injection

Enorth Webpublisher CMS - thisday SQL Injection source: https://www.securityfocus.com/bid/64110/info Enorth Webpublisher is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit will allow an attacker to compromise the...

ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the AgentLogUploadServlet script to properly sanitize user-supplied input to the 'fileName' parameter. A remote, unauthenticated attacker can exploit thi...

D-Link DIR-Series Routers - '/model/__show_info.php' Local File Disclosure

source: https://www.securityfocus.com/bid/64043/info Multiple D-Link DIR series routers are prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information...

WordPress Amerisale-Re Plugin XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

Cisco Services Portal File Download Vulnerability

A vulnerability in the ''Files Available for Download'' window of Cisco Intelligent Automation for Cloud could allow an authenticated, remote attacker to download arbitrary files from the system. The vulnerability is due to a failure to perform sufficient server-side validation of user-supplied...

Testa OTMS - Multiple SQL Injections

Testa OTMS - Multiple SQL Injections source: https://www.securityfocus.com/bid/63773/info Testa OTMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulati...

Horde Groupware Webmail Edition Ingo Filter Cross-Site Request Forgery (CVE-2013-6275)

A Cross-Site Request Forgery CSRF vulnerability has been reported in Horde Groupware Webmail Edition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by convincing the user to follow a malicious link or visit an attacker...

HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability

Added: 10/30/2013 CVE: CVE-2013-2367 BID: 61506 OSVDB: 95824 Background HP SiteScope is an agentless software application used to monitor the availability and performance of distributed IT infrastructures including servers, operating systems, network and Internet services, applications and...

WordPress WooCommerce 2.0.17 Cross Site Scripting

Wordpress WooCommerce Plugin 2.0.17 Cross-Site Scripting Vulnerability Vendor: WooThemes Product web page: http://www.woothemes.com Affected version: 2.0.17 and 2.0.14 Summary: WooCommerce is an open source e-commerce plugin for WordPress. Desc: The plugin suffers from a XSS issue due to a...

Wordpress WooCommerce Plugin 2.0.17 Cross-Site Scripting Vulnerability

Summary WooCommerce is an open source e-commerce plugin for WordPress. Description The plugin suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'hide-wc-extensions-message' parameter in the 'admin/woocommerce-admin-settings.php' script. Attackers can exploi...

Bugzilla 4.2 - Tabular Reports Cross-Site Scripting

source: https://www.securityfocus.com/bid/63205/info Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in...

WordPress Plugin WP-Realty - 'listing_id' SQL Injection

source: https://www.securityfocus.com/bid/63217/info WP-Realty plugin for WordPress is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

WordPress Plugin Woopra Analytics - ofc_upload_image.php Arbitrary PHP Code Execution

WordPress Plugin Woopra Analytics - ofcuploadimage.php Arbitrary PHP Code Execution source: https://www.securityfocus.com/bid/62876/info The Woopra Analytics Plugin for WordPress is prone to an arbitrary PHP code-execution vulnerability because it fails to properly validate user-supplied input. A...

SecurityCenter devform.php message Parameter XSS

The version of Tenable Network Security SecurityCenter installed on the remote host contains the 'devform.php' script. This PHP script is affected by a cross-site scripting vulnerability because the application does not properly validate user-supplied input to the 'message' parameter. An attacker...

OTRS ITSM XSS Vulnerability (OSA-2013-02)

OTRS ITSM is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrsitsm"; i...