EUVD-2008-1966

Malware in sbrugna...

Cezanne 7 - CFLookup.asp FUNID Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/28773/info Cezanne Software is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker ...

CVE-2008-1969

Multiple cross-site scripting XSS vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the 1 LookUPId and 2 CbFun parameters to a CFLookUP.asp; 3 TitleParms, 4 WidgetsHeights, 5 WidgetsLinks, and 6 WidgetsTitles parameters to b...

Sql injection

Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to 1 CFLookup.asp and 2 CznCommon/CznCustomContainer.asp...

CVE-2008-1968

Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to 1 CFLookup.asp and 2 CznCommon/CznCustomContainer.asp...

CVE-2008-1967

Cross-site scripting XSS vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject arbitrary web script or HTML via the SleUserName parameter...

CVE-2008-1967

CVE-2008-1967 describes a Cross-site Scripting (XSS) vulnerability in CFLogon/CFLogon.asp for Cezanne 6.5.1 and 7, exploitable via the SleUserName parameter to inject arbitrary web script/HTML. Affected component: CFLogon.asp (Cezanne); root cause: insufficient input validation for SleUserName le...

CVE-2008-1968

CVE-2008-1968 affects Cezanne 7 with multiple SQL injection flaws exploitable via the FUNID parameter in CFLookup.asp and CznCommon/CznCustomContainer.asp. The underlying issue is unsafely constructed SQL from the FUNID input, enabling remote authenticated users to execute arbitrary SQL commands....

CVE-2008-1968

Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to 1 CFLookup.asp and 2 CznCommon/CznCustomContainer.asp...