Iciniti Store SQL Injection - Security Advisory - SOS-12-003

Sense of Security - Security Advisory - SOS-12-003 Release Date. 06-Mar-2012 Last Update. - Vendor Notification Date. 28-Jul-2011 Product. Iciniti Store Platform. Windows Affected versions. 4.3.3683.31484 verified, and possibly others Severity Rating. High Impact. Manipulation of data Attack...

Iciniti Store SQL Injection Vulnerability

Exploit for asp platform in category web applications Vendor Notification Date. 28-Jul-2011 Product. Iciniti Store Platform. Windows Affected versions. 4.3.3683.31484 verified, and possibly others Severity Rating. High Impact. Manipulation of data Attack Vector. Remote without authentication...

Iciniti Store - SQL Injection

Iciniti Store - SQL Injection Sense of Security - Security Advisory - SOS-12-003 Release Date. 06-Mar-2012 Last Update. - Vendor Notification Date. 28-Jul-2011 Product. Iciniti Store Platform. Windows Affected versions. 4.3.3683.31484 verified, and possibly others Severity Rating. High Impact...

Iciniti Store - SQL Injection

Sense of Security - Security Advisory - SOS-12-003 Release Date. 06-Mar-2012 Last Update. - Vendor Notification Date. 28-Jul-2011 Product. Iciniti Store Platform. Windows Affected versions. 4.3.3683.31484 verified, and possibly others Severity Rating. High Impact. Manipulation of data Attack...

LDAP Account Manager Pro 3.6 跨站脚本和HTML注入漏洞

LDAP Account Manager LAM是一个基于浏览器的LDAP帐号管理系统 LDAP Account Manager LAM存在多个持久型输入校验漏洞，允许攻击者在应用程序段实现恶意脚本代码，成功利用漏洞操作数据或劫持会话user/mod/admin 另外也受客户端跨站脚本漏洞，允许攻击者劫持目标用户/admin会话 0 LDAP Account Manager Pro 3.6 厂商解决方案 目前没有详细解决方案提供： http://lam.sourceforge.net/index.htm...

PostgreSQL 8.x/9.x 存在多个安全漏洞

CVE-2012-0866 CVE-2012-0867 CVE-2012-0868 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集 PostgreSQL存在多个安全漏洞，允许恶意用户绕过部分安全限制，进行伪造攻击或操作某些数据 -在触发函数上没有对CREATE TRIGGER进行正确的权限检查，可利用此漏洞标记触发函数为SECURITY DEFINER，可授权EXECUTE权限 -在校验SSL证书的公用名时不正确把名称截断为32个字符，可导致不正确校验伪造证书...

Design/Logic Flaw

The Ming Blacklist Free vc.software.blacklist application 1.8.1 and 1.9.2.1 for Android does not properly protect data, which allows remote attackers to read or modify blacklists and a contact list via a crafted application that launches a "data-flow attack."...

AlstraSoft EPay Enterprise v4.0 Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0...

SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability

Summary SetSeed is a self-hosted CMS which lets you rapidly build and deploy complete websites and online stores for your clients. Description SetSeed CMS is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the vulnerable script using the cookie input...

Microsoft Excel 2007 SP2 - Buffer Overwrite (MS11-021)

Abysssec Research 1 Advisory information Title : Microsoft Excel 2007 SP2 Buffer Overwrite Vulnerability Analysis : Abysssec.com Vendor : http://www.microsoft.com Impact : Critical Contact : info at abysssec.com Twitter : @abysssec Microsoft : A remote code execution vulnerability exists in the w...

VMware ESX Server多个安全漏洞

VMware ESX 服务器是在通用环境下分区和整合系统的虚拟主机软件。它是具有高级资源管理功能高效，灵活的虚拟主机平台。 VMware ESX Server在实现上存在多个安全漏洞，可被本地恶意用户利用泄露敏感信息、操作某些数据、绕过某些安全限制、执行欺骗攻击、执行DNS投毒攻击。 VMWare ESX Server 4.x VMWare ESX Server 3.x 厂商补丁： VMWare ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.vmware.com...

Django开发框架多个安全漏洞

Bugtraq ID: 49573 Django是一款开放源代码的Web应用框架，由Python写成。 Django存在多个安全漏洞，允许攻击者获得敏感信息，操作数据，进行缓存毒药攻击或进行拒绝服务攻击。 1当使用缓存后端时django.contrib.sessions中处理会话存在错误，可被利用操作会话信息。要成功个利用漏洞需要已知会话KEY和应用程序允许攻击者使用合法会话KEY储存字典类对象到缓冲中。 2Django模型系统包括一个字段类型-- URLField...

KimiaCMS SQL Injection

+-------------------------------+------------------------------+ KimiaCMS "productsinfo.php?id=" SQL Injection Vulnerability Author: R3VANBASTARD [email protected] HomePage: INDONESIA RAYA - JOGJA - WARUNG BOTO +-------------------------------+------------------------------+ X...

Progea Movicon 'TCPUploadServer.exe' Multiple Vulnerabilities

Progea Movicon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AContent 1.1 Multiple SQL Injection Vulnerabilities

Summary AContent is an open source learning content authoring system and respository used to create interoperable, accessible, adaptive Web-based learning content. It can be used along with learning management systems to develop, share, and archive learning materials. Description Input passed via...

ATutor 2.0.2 Multiple Remote Vulnerabilities (SQLi/XSS/PD)

Summary ATutor is an Open Source Web-based Learning Content Management System LCMS designed with accessibility and adaptability in mind. Educators can quickly assemble, package, and redistribute Web-based instructional content, easily retrieve and import prepackaged content, and conduct their...

Oracle PeopleSoft Enterprise远程FSCM漏洞(CVE-2011-2272)

BUGTRAQ ID: 48777 CVE ID: CVE-2011-2272 PeopleSoft企业软件集成多个商务功能，包括人事、客户关系、供求关系、财务等管理。PeopleSoft PeopleTools网关管理Servlet存在信息泄露问题， PeopleSoft的Enterprise PeopleTools在HRMS的实现上存在安全漏洞，远程攻击者可通过'HTTPs'协议利用此漏洞影响eProcurement子组件，非法更新、插入、删除PeopleSoft Enterprise FSCM中的可访问数据，非法读取其子集数据。 Oracle PeopleSoft Enterpri...

PG eLMS Pro vDEC_2007_01 Multiple Blind SQL Injection Vulnerabilities

Summary eLMS Pro solution is an outstanding and yet simple Learning Management system. Our product is designed for any education formations: from small distance training companies up to big colleges and universities. The system allows to build courses, import SCORM content, deploy online learning...

Microsoft Windows CSRSS ConsoleNumberOfCommand Code Execution (MS11-056; CVE-2011-1283)

An elevation of privilege vulnerability has been reported in Windows CSRSS. Remote attackers can exploit this vulnerability to run arbitrary code in kernel mode. Successful exploitation may enable an attacker to install programs; view, change, or delete data; or create new accounts with full user...

Workaround for Microsoft Office Excel BIFF5 Records Vulnerabilities (MS11-045; CVE-2011-1273)

A remote code execution vulnerability exists in the way that Microsoft Excel handles specially crafted Excel files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; o...