ArticleFR 11.06.2014 - data.php Privilege Escalation

ArticleFR 11.06.2014 - data.php Privilege Escalation Advisory ID: HTB23219 Product: ArticleFR Vendor: Free Reprintables Vulnerable Versions: 11.06.2014 and probably prior Tested Version: 11.06.2014 Advisory Publication: June 11, 2014 without technical details Vendor Notification: June 11, 2014...

kernel security, bug fix, and enhancement update

2.6.32-431.23.3 - netdrv pppol2tp: fail when socket option level is not SOLPPPOL2TP 1119461 1119462 CVE-2014-4943 2.6.32-431.23.2 - kernel utrace: force IRET path after utracefinishvfork Oleg Nesterov 1115932 1115933 CVE-2014-4699 2.6.32-431.23.1 - net iptunnel: fix iptunnelfind to return NULL in...

E2 2844 SQL Injection Vulnerability

E2 version 2844 suffers from a remote SQL injection vulnerability. Product: Е2 Vendor: Ilya Birman Vulnerable Versions: v2844 and probably prior Tested Version: v2844 Advisory Publication: July 2, 2014 without technical details Vendor Notification: July 2, 2014 Vendor Patch: July 3, 2014 Public...

SQL Injection Vulnerability in ArticleFR

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in ArticleFR, which can be exploited to perform SQL Injection attacks and gain complete control over vulnerable website. 1 SQL Injection in ArticleFR: CVE-2014-5097 The vulnerability exists due to insufficient...

CVE-2014-3321

Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface BVI routing is enabled, allows remote attackers to cause a denial of service chip and card hangs via a series of crafted MPLS packets, aka Bug ID CSCuo91149...

CVE-2014-3321: Improper Input Validation

Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface BVI routing is enabled, allows remote attackers to cause a denial of service chip and card hangs via a series of crafted MPLS packets, aka Bug ID CSCuo91149...

PT-2014-5215

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 4.3.4 and earlier Description The issue allows remote attackers to cause a denial of service via a series of crafted Multiprotocol Label Switching MPLS packets when bridge-group virtual interface BVI routing is enabled...

Kanboard 1.0.5 Cross Site Request Forgery Vulnerability

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI. Product: Kanboard Vendor: http://kanboard.net/ Vulnerable Versions: 1.0....

Kanboard 1.0.5 Cross Site Request Forgery

Advisory ID: HTB23217 Product: Kanboard Vendor: http://kanboard.net/ Vulnerable Versions: 1.0.5 and probably prior Tested Version: 1.0.5 Advisory Publication: May 28, 2014 without technical details Vendor Notification: May 28, 2014 Vendor Patch: June 30, 2014 Public Disclosure: July 2, 2014...

Webmatic 3.1.1 - Blind SQL Injection

No description provided by source. Advisory ID: HTB23096 Product: Webmatic Vendor: valarsoft.com Vulnerable Versions: 3.1.1 and probably prior Tested Version: 3.1.1 Vendor Notification: 13 June 2012 Public Disclosure: 4 July 2012 Vulnerability Type: Blind SQL Injection CVE Reference: CVE-2012-335...

podcast generator 1.3 - Multiple Vulnerabilities

No description provided by source. ======================================== Vulnerability ID: HTB22801 Reference: http://www.htbridge.ch/advisory/localfileinclusioninpodcastgenerator.html Product: Podcast Generator Vendor: Alberto Betella http://podcastgen.sourceforge.net/ Vulnerable Version: 1.3...

lotuscms 3.0.3 - Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22886 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerabili...

e107 0.7.23 - SQL Injection Vulnerability.

No description provided by source. Vulnerability ID: HTB22604 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1072.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 13 September 20...

runcms 2.2.2 - Multiple Vulnerabilities

No description provided by source. Source: http://packetstormsecurity.org/files/view/98472/runcms-sqlxss.txt ================================ Vulnerability ID: HTB22820 Reference: http://www.htbridge.ch/advisory/sqlinjectioninruncms.html Product: RunCMS Vendor: http://www.runcms.org/...

appRain 3.0.2 - Blind SQL Injection Vulnerability

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

Ecomat CMS Remote SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22390 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinecomatcms.html Product: Ecomat CMS Vendor: Codefabrik GmbH Vulnerable Version: 5.0 and Probably Prior Versions Vendor Notification: 18 May 2010 Vulnerability Type: S...

LiSK CMS 4.4 - SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22373 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinliskcms1.html Product: LiSK CMS Vendor: Createch-group Vulnerable Version: 4.4 Vendor Notification: 06 May 2010 Vulnerability Type: SQL Injection Status: Not Fixed,...

IWantOneButton 3.0.1 Wordpress Plugin Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22846 Reference: http://www.htbridge.ch/advisory/sqlinjectioniniwantonebuttonwordpres splugin.html Product: IWantOneButton wordpress plugin Vendor: Daniel Sands http://www.danielsands.co.cc/ Vulnerable Version: 3.0.1 Vendor Notification: 10...

piwigo 2.3.3 - Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23085 Product: Piwigo Vendor: Piwigo project Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Vendor Notification: 4 April 2012 Vendor Patch: 8 April 2012 Public Disclosure: 25 April 2012 Vulnerability Type: Directory Path...

Zend Java Bridge - Remote Code Execution (ZDI-11-113)

No description provided by source. / Zend Java Bridge v3.1 - Remote Code Execution ZDI-11-113 Copyright c 2010 Luca Carettoni ZJB.java v0.2 - 4 August 2010 Usage java -jar zjb.jar IP PORT 'CMD' Default: 10001/tcp Version affected Zend Server v5.0.2, Zend Server Community Edition v5.0.2 and previo...