ConPresso CMS 4.07 Session Fixation / XSS

HACKATTACK Advisory 25012009ConPresso CMS 4.07 - Session Fixation, XFS, XSS Details Product: ConPresso CMS 4.07 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.de/ Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

ConPresso CMS 4.07 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/33436/info ConPresso CMS is prone to multiple remote vulnerabilities: - A cross-site scripting vulnerability - A cross-domain scripting vulnerability - A session-fixation vulnerability An attacker can exploit these issues to execute arbitrary script code...

ConPresso CMS 4.07 - Multiple Remote Vulnerabilities

ConPresso CMS 4.07 - Multiple Remote Vulnerabilities source: https://www.securityfocus.com/bid/33436/info ConPresso CMS is prone to multiple remote vulnerabilities: - A cross-site scripting vulnerability - A cross-domain scripting vulnerability - A session-fixation vulnerability An attacker can...

CVE-2006-5127

Multiple cross-site scripting XSS vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary web script or HTML via 1 the nr parameter in detail.php, 2 the msg parameter in dbmysql.inc.php, and 3 the pos parameter in index.php...

CVE-2006-5128

SQL injection vulnerability in index.php in Bartels Schoene ConPresso before 4.0.5a allows remote attackers to execute arbitrary SQL commands via the nr parameter...

CVE-2006-5128

SQL injection vulnerability in index.php in Bartels Schoene ConPresso before 4.0.5a allows remote attackers to execute arbitrary SQL commands via the nr parameter...

CVE-2006-5127

Multiple cross-site scripting XSS vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary web script or HTML via 1 the nr parameter in detail.php, 2 the msg parameter in dbmysql.inc.php, and 3 the pos parameter in index.php...

CVE-2006-5128

CVE-2006-5128 affects Bartels Schoene ConPresso prior to 4.0.5a. Vulnerability: SQL injection in index.php via the nr parameter that allows remote execution of arbitrary SQL commands. Impact: disclosure/modification of data as described in CVSS metrics. Remediation: upgrade to ConPresso 4.0.5a or...

CVE-2006-5127

CVE-2006-5127 affects Bartels Schoene ConPresso prior to version 4.0.5a. The vulnerability is multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via (1) nr in detail.php, (2) msg in db_mysql.inc.php, and (3) pos in index.php. Root cause: X...

[MajorSecurity Advisory #28]ConPresso CMS - Multiple Cross Site Scripting and SQL Injection Issues

MajorSecurity Advisory 28ConPresso CMS - Multiple XSS and SQL Injection Issues Details ======= Product: ConPresso CMS Affected Version: =4.0.4a Immune Version: 4.0.5a Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.com/ Vendor-Status: informed Advisory-Status:...