Kloxo SQL Injection and Remote Code Execution

This module exploits an unauthenticated SQL injection vulnerability affecting Kloxo, as exploited in the wild on January 2014. The SQL injection issue can be abused in order to retrieve the Kloxo admin cleartext password from the database. With admin access to the web control panel, remote PHP co...

IBM Cognos Command Center会话固定漏洞

Bugtraq ID:64267 CVE ID:CVE-2013-4001 IBM Cognos是一款集成商业智能（BI）和计划的解决方案。 IBM Cognos Command Center存在一个会话固定漏洞，允许远程攻击者利用漏洞劫持用户会话，未授权访问应用。 0 IBM Cognos Command Center 10.1 厂商补丁： IBM ----- IBM Cognos Command Center 10.2已经修复该漏洞，请到厂商相关页面下载： http://www.ibm.com/support/docview.wss?uid=swg24035464...

IBM Cognos Command Center跨站请求伪造漏洞

Bugtraq ID:64268 CVE ID:CVE-2013-4000 IBM Cognos是一款集成商业智能（BI）和计划的解决方案。 IBM Cognos Command Center存在一个跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 IBM Cognos Command Center 10.1 http://www.ibm.com/support/docview.wss?uid=swg24035464...

CVE-2013-4000

Multiple cross-site request forgery CSRF vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 start or 2 stop services...

CVE-2013-4001

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 start or 2 stop services...

Session fixation

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

CVE-2013-4000

Multiple cross-site request forgery CSRF vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 start or 2 stop services...

CVE-2013-4001

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie...

CVE-2013-4000

The CVE-2013-4000 entry concerns IBM Cognos Command Center with multiple CSRF vulnerabilities that allow remote attackers to hijack the administrator session for requests that start or stop services. Affected product: IBM Cognos Command Center prior to version 10.2. The core issue is CSRF in the ...

CVE-2013-4001

CVE-2013-4001 affects IBM Cognos Command Center (before 10.2) with a session/fixation vulnerability that lets an attacker hijack web sessions via an authorization cookie. The issue is confirmed across multiple sources (NVD/NVD-related entries and IBM security bulletin); IBM states that Cognos Com...

CVE-2013-3979

Multiple cross-site scripting XSS vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center aka Star Command Center or Star Analytics before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML vi...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center aka Star Command Center or Star Analytics before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2013-3979

CVE-2013-3979: Multiple XSS vulnerabilities in the Web Client’s help pages (Web\Content\Help) of IBM Cognos Command Center (Star Command Center/Star Analytics) prior to version 10.1, triggered when using Internet Explorer. Exploitation is via unspecified vectors by remote authenticated users; imp...

Astaro Command Center crossite scripting

Multiple crossite scripting vulnerabilities...

Astaro Command Center v2.x - Multiple Web Vulnerabilities

Title: ====== Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: ===== 2012-04-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=4 VL-ID: ===== 4 Introduction: ============= We are pleased to announce the General Availability of the Astaro Command Center...

Astaro Command Center v2.x - Multiple Web Vulnerabilities

Title: ====== Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: ===== 2012-04-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=4 VL-ID: ===== 4 Introduction: ============= We are pleased to announce the General Availability of the Astaro Command Center...

Astaro Command Center 2.x Cross Site Scripting

Title: ====== Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: ===== 2012-04-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=4 VL-ID: ===== 4 Introduction: ============= We are pleased to announce the General Availability of the Astaro Command Center...

Astaro Command Center v2.x - Multiple Web Vulnerabilities

Document Title: =============== Astaro Command Center v2.x - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=4 Release Date: ============= 2012-04-02 Vulnerability Laboratory ID VL-ID: ==================================== 4...

Astaro Command Center v2.x - Multiple Web Vulnerabilities

Document Title: =============== Astaro Command Center v2.x - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=4 Release Date: ============= 2012-04-02 Vulnerability Laboratory ID VL-ID: ==================================== 4...