Multiple vulnerabilities in EspoCRM

High-Tech Bridge Security Research Lab discovered multiple high-risk vulnerabilities in EspoCRM, which can be exploited by remote attacker to execute arbitrary PHP code on a vulnerable system, reinstall the application from scratch, and compromise the entire system as the result. EspoCRM is also...

WordPress Photo Gallery 1.1.30 Cross Site Scripting Vulnerability

WordPress Photo Gallery plugin version 1.1.30 suffers from a cross site scripting vulnerability. Product: Photo Gallery WordPress plugin Vendor: http://web-dorado.com/ Vulnerable Versions: 1.1.30 and probably prior Tested Version: 1.1.30 Advisory Publication: September 10, 2014 without technical...

Textpattern 4.5.5 Cross Site Scripting Vulnerability

Textpattern version 4.5.5 suffers from a cross site scripting vulnerability. Product: Textpattern Vendor: http://textpattern.com/ Vulnerable Versions: 4.5.5 and probably prior Tested Version: 4.5.5 Advisory Publication: July 9, 2014 without technical details Vendor Notification: July 9, 2014 Vend...

Textpattern 4.5.5 Cross Site Scripting

Advisory ID: HTB23223 Product: Textpattern Vendor: http://textpattern.com/ Vulnerable Versions: 4.5.5 and probably prior Tested Version: 4.5.5 Advisory Publication: July 9, 2014 without technical details Vendor Notification: July 9, 2014 Vendor Patch: September 20, 2014 Public Disclosure: October...

webEdition 6.3.8.0 (SVN-Revision: 6985) - Path Traversal

No description provided by source. Advisory ID: HTB23227 Product: webEdition Vendor: webEdition e.V. Vulnerable Versions: 6.3.8.0 SVN-Revision: 6985 and probably prior Tested Version: 6.3.8.0 SVN-Revision: 6985 Advisory Publication: August 6, 2014 without technical details Vendor Notification:...

Wordpress All In One WP Security Plugin 3.8.2 - SQL Injection

No description provided by source. Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without technical details Vendor...

WordPress All In One WP Security Plugin 3.8.2 SQL Injection Vulnerability

WordPress All In One WP Security plugin version 3.8.2 suffers from multiple remote SQL injection vulnerabilities. Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without technical details Vendor Notification: September 3, 2014 Vendor...

webEdition 6.3.8.0 (SVN-Revision: 6985) - Directory Traversal

webEdition 6.3.8.0 SVN-Revision: 6985 - Directory Traversal Advisory ID: HTB23227 Product: webEdition Vendor: webEdition e.V. Vulnerable Versions: 6.3.8.0 SVN-Revision: 6985 and probably prior Tested Version: 6.3.8.0 SVN-Revision: 6985 Advisory Publication: August 6, 2014 without technical detail...

webEdition 6.3.8.0 (SVN-Revision: 6985) - Directory Traversal

Advisory ID: HTB23227 Product: webEdition Vendor: webEdition e.V. Vulnerable Versions: 6.3.8.0 SVN-Revision: 6985 and probably prior Tested Version: 6.3.8.0 SVN-Revision: 6985 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August 6, 2014 Vendor Patch: Septembe...

MODX Revolution 2.3.1-pl Cross Site Scripting

Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...

Reflected Cross-Site Scripting (XSS) in Google Calendar Events WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in Google Calendar Events WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin. 1 Reflected Cross-Site Scripting XSS in Google Calend...

Two XSS in Contact Form DB WordPress plugin

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Contact Form DB WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin installed. 1 Two Cross-Site Scripting XSS...

Cisco IOS XR NetFlow and Network Processor (NP) Chip DoS (Typhoon-based Line Cards)

The remote Cisco device is running a version of Cisco IOS XR software that is potentially affected by a denial of service vulnerability related the handling of a maliciously crafted packet with a multicast destination MAC address routed by a bridge-group virtual interface. Note that this issue on...

BlackCat CMS 1.0.3 Cross Site Scripting

Advisory ID: HTB23228 Product: BlackCat CMS Vendor: Black Cat Development Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: August 13, 2014 without technical details Vendor Notification: August 13, 2014 Vendor Patch: August 13, 2014 Public Disclosure:...

MyWebSQL 3.4 Cross Site Scripting

Advisory ID: HTB23221 Product: MyWebSQL Vendor: http://mywebsql.net/ Vulnerable Versions: 3.4 and probably prior Tested Version: 3.4 Advisory Publication: June 25, 2014 without technical details Vendor Notification: June 25, 2014 Public Disclosure: September 3, 2014 Vulnerability Type: Cross-Site...

Cisco IOS XR MPLS and Network Processor (NP) Chip DoS (Typhoon-based Line Cards)

The remote Cisco device is running a version Cisco IOS XR software that is potentially affected by a denial of service vulnerability related the handling of maliciously crafted MPLS Multiprotocol Label Switching packets routed by a bridge-group virtual interface. Note that this issue only affects...

Jamroom 5.2.6 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Jamroom Vendor: Talldude Networks, LLC Vulnerable Versions: 5.2.6 and probably prior Tested Version: 5.2.6 Advisory Publication: July 23, 2014 without technical details Vendor Notification: July 23, 2014 Vendor Patch: July 23, 2014...

Jamroom 5.2.6 Cross Site Scripting

Advisory ID: HTB23224 Product: Jamroom Vendor: Talldude Networks, LLC Vulnerable Versions: 5.2.6 and probably prior Tested Version: 5.2.6 Advisory Publication: July 23, 2014 without technical details Vendor Notification: July 23, 2014 Vendor Patch: July 23, 2014 Public Disclosure: August 13, 2014...