Third-Party Software Library Risks Scrutinized at Black Hat

Enterprise application developers are under real pressures to push projects out the door quickly and cheaply, and each new version certainly has to be better than the last. This forces them to make decisions that, at a minimum, improve efficiency—and also introduce additional risks. Of particular...

CVE-2013-5855

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a 1 tag or 2 EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting XSS attacks via application-specific vectors...

Netsparker v3.5 - Web Application Security Scanner

Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...

WordPress Plugin BSK PDF Manager - wp-adminadmin.php Multiple SQL Injections

WordPress Plugin BSK PDF Manager - wp-adminadmin.php Multiple SQL Injections source: https://www.securityfocus.com/bid/68488/info BSK PDF Manager plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting these...

AtomCMS - SQL Injection Arbitrary File Upload

AtomCMS - SQL Injection Arbitrary File Upload source: https://www.securityfocus.com/bid/68437/info AtomCMS is prone to an SQL-injection vulnerability and an arbitrary file-upload vulnerability. Exploiting these issues could allow an attacker to upload arbitrary files, compromise the application,...

PerlSoft Gästebuch Version: 1.7b 'admincenter.cgi' Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33525/info PerlSoft Gästebuch is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input. Note that a...

Prodder 0.4 Arbitrary Shell Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/18068/info Prodder is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute...

Enthrallweb eClassifieds dirSub.asp sid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/21192/info eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...

AmpJuke 0.7.5 'index.php' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31592/info AmpJuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

MidiCart PHP Item_List.PHP SecondGroup Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13514/info MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Jax Petition 3.06 Book smileys.php languagepack Parameter Local File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/22072/info Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities using directory-traversal string...

Ocean12 Calendar Manager 1.0 Admin Form SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13279/info Ocean12 Calendar Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

Instant Photo Gallery 1.0 portfolio.php cat_id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15659/info Instant Photo Gallery is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successfu...

PHP Lite Calendar Express 2.2 auth.php cid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/14504/info Calendar Express is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an...

OpenFAQ 0.4 Validate.PHP HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17860/info OpenFAQ is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script cod...

SoftBiz Dating Script 1.0 featured_photos.php browse Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/18605/info Softbiz Dating Script is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow a...

Ocean12 Technologies Calendar Manager Pro 1.0 1 admin/main.asp date Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17877/info Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to...

CLUB Nuke 2.0 - Multiple SQL-Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19442/info CLUB-Nuke is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise...

MidiCart ASP Item_Show.ASP ID2006quant Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21273/info MidiCart ASP is prone to an SQL injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Foro Domus 2.10 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/16154/info Foro Domus is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabilities...