Code injection

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/frmSite.aspx, 2 Admin/frmSites.aspx, 3 Admin/frmViewReports.aspx, 4...

CVE-2011-2152: Exposure of Sensitive Information to an Unauthorized Actor

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

PT-2011-3640

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0 Description The issue allows remote attackers to obtain sensitive information by exploiting a "cross-domain Referer leakage" issue. This is achieved through GET requests with query strings for specific API...

CVE-2011-2149: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to 1 Admin/frmSite.aspx, 2 Default.aspx, 3 Services/SiteAdmin.asmx, or 4 Client/frmViewReports.aspx; certain cookies to 5...