CVE-2015-2858

The CVE-2015-2858 issue affects the Datalex airline booking software (pre-2015-09-03) and stems from an authorization-check bypass in how the application processes the profileId parameter. By modifying profileId in POST requests to ValidateFormAction.do or ProfileConfirmEditAddressAction.do, an a...

Datalex airline booking software allowed authorization bypass for arbitrary users

Overview Datalex provides a suite of software offerings for the airline industry which supports a customizable flight browsing, booking, payment, and analytics. The Datalex airline booking software contained an error in its error handling routines which allows authorization bypass and loss of...

CVE-2015-7320

Multiple cross-site scripting XSS vulnerabilities in cpabcappointmentsadminintbookingslist.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7319

SQL injection vulnerability in cpabcappointmentsadminintcalendarlist.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username...

Sql injection

SQL injection vulnerability in cpabcappointmentsadminintcalendarlist.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username...

CVE-2015-7319

CVE-2015-7319 affects the WordPress plugin “Appointment Booking Calendar” prior to version 1.1.8. The vulnerability is a SQL injection in cpabc_appointments_admin_int_calendar_list.inc.php that allows remote attackers to execute arbitrary SQL commands via vectors related to updating the username....

CVE-2015-7320

CVE-2015-7320 documents multiple reflective XSS vulnerabilities in the WordPress plugin Appointment Booking Calendar, specifically in the file cpabc_appointments_admin_int_bookings_list.inc.php. Affected version: 1.1.7 (WordPress DWBooster’s Appointment Booking Calendar). The root cause is lack o...

WordPress Appointment Booking Calendar 1.1.7 XSS Vulnerability

WordPress Appointment Booking Calendar plugin version 1.1.7 suffers from multiple cross site scripting vulnerabilities. Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking...

WordPress Appointment Booking Calendar 1.1.7 XSS

Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking Calendar Affected version: 1.1.7 Fixed version: 1.1.8 Reported by: Ibéria Medeiros Vulnerability Details:...

WordPress Appointment Booking Calendar Plugin <= 1.1.7 - Multiple XSS

These vulnerabilities allow an attacker to inject an arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...

WordPress Appointment Booking Calendar Plugin <= 1.1.7 - SQL Injection

This vulnerability allows an attacker to execute arbitrary SQL commands via unspecified vectors that are related to updating the username. Solution Update the plugin...

Google Adsense & Hotel Booking <= 1.0.5 - Open Proxy

Plugin is still affected and has been closed. The code in ./plugin/google-adsense-and-hotel-booking/proxy.php allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks, or DoS a site if the POST request is pointed back at itself causing a loop...

WordPress Google Adsense and Hotel Booking Plugin <= 1.05 - Open Redirection

The vulnerability is in the ./plugin/google-adsense-and-hotel-booking/proxy.php. It allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks. Solution Update the plugin...

Google Adsense & Hotel Booking <= 1.0.5 - Open Proxy

Plugin is still affected and has been closed. The code in ./plugin/google-adsense-and-hotel-booking/proxy.php allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks, or DoS a site if the POST request is pointed back at itself causing a loop...

Threat Outbreak Alert RuleID17198: Email Messages Distributing Malicious Software on August 10, 2015

Medium Alert ID: 40389 First Published: 2015 August 10 16:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17198 may contain the following files: Name |...

neworleansonline.com XSS vulnerability

Vulnerable URL: http://www.neworleansonline.com/book/rooms/lodging.php?lodgingType=1=%22%3E%3Csvg%2Fonload%3Dalert%28%2Fxssposed.org%2F%29%3E=1=&Submit2;=Search+for+Lodging Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability...

Pinpoint Booking System <= 2.0 - Authenticated Blind SQL Injection

The Pinpoint Booking System – 1 WordPress Booking Plugin WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

WordPress Booking System Plugin <= 2.0 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands via "language" parameter. Solution Update the plugin...

Hotels.com Phishing Scam Duping Travelers

An undisclosed number of travelers who use Hotels.com may have been victims of a phishing scheme. The company said some customers were recently tricked into disclosing their names, phone numbers, email addresses and travel bookings. An individual was reportedly able to convince customers that the...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/Sales/meb_his.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...