EUVD-2011-5205

Malware in sbrugna...

CVE-2011-5306

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

CVE-2011-5305

Multiple cross-site scripting XSS vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via 1 the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, 2 the typ parameter to cgi-bin/admin/artikeladmin.cgi, or 3 the suchbegriff parameter to...

网达信联电子采购系统 /epro/ebid/viewInvite1.asp 文件 InviteId 参数SQL注入漏洞

No description provided by source...

某电子采购系统通用SQL注入漏洞，影响众多企业

简要描述： 某电子采购系统通用SQL注入漏洞，影响众多企业 详细说明： 软件厂商：北京网达信联科技发展有限公司 系统名称：电子采购平台 漏洞文件：epro/ebid/viewInvite.asp 由于inviteid参数过滤不严格，导致注入存在 漏洞证明： 部分案例： 彩虹集团：http://caigou.irico.com.cn/Rat/ebid/viewInvite.asp?inviteid=0000024185 中国南车：http://zhaobiao.cdjcc.com/epro/ebid/viewInvite.asp?inviteid=0000002597...

CosmoShop ePRO Cross-Site Request Forgery Vulnerability

CosmoShop ePRO is a cloud e-commerce system based on Magento. The system is able to quickly complete domain name setup, online store installation, server deployment and product launch. A cross-site request forgery vulnerability exists in CosmoShop ePRO 10.05.00, which allows remote attackers to...

Multiple Cross-Site Scripting Vulnerabilities in CosmoShop ePRO

CosmoShop ePRO is a cloud e-commerce system based on Magento. The system is able to quickly complete domain name setup, online store installation, server deployment and product launch. CosmoShop ePRO suffers from multiple cross-site scripting vulnerabilities that can be exploited by remote...

CVE-2011-5306

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

CVE-2011-5305

Multiple cross-site scripting XSS vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via 1 the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, 2 the typ parameter to cgi-bin/admin/artikeladmin.cgi, or 3 the suchbegriff parameter to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via 1 the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, 2 the typ parameter to cgi-bin/admin/artikeladmin.cgi, or 3 the suchbegriff parameter to...

CVE-2011-5306

CVE-2011-5306 describes a Cross-Site Request Forgery (CSRF) vulnerability in CosmoShop ePRO 10.05.00. The flaw affects the CGI component cgi-bin/admin/setup_edit.cgi and enables remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. T...

CVE-2011-5305

Multiple cross-site scripting XSS vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via 1 the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, 2 the typ parameter to cgi-bin/admin/artikeladmin.cgi, or 3 the suchbegriff parameter to...

CVE-2011-5305

CVE-2011-5305 affects CosmoShop ePRO 10.05.00 with multiple XSS vulnerabilities. The issue arises from unsanitized inputs in: (1) rcopy to cgi-bin/admin/rubrikadmin.cgi, (2) typ to cgi-bin/admin/artikeladmin.cgi, and (3) suchbegriff to cgi-bin/admin/shophilfe_suche.cgi. Remote attackers can injec...

CVE-2011-5306

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

CVE-2011-5305: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via 1 the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, 2 the typ parameter to cgi-bin/admin/artikeladmin.cgi, or 3 the suchbegriff parameter to...

PT-2015-3502

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. Recommendations For version 10.05.00, a...

PT-2015-3501

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the rcopy parameter to...

CVE-2011-5306: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

Authentication-Bypass in CosmoShop ePRO V10.17.00 (and lower, maybe higher)

Issue: Authentication-Bypass in CosmoShop ePRO V10.17.00 and lower, maybe higher Author: l0om http://l0om.org Date: 26.02.2013 Overview: Cosmoshop provides an admin backup-function which saves .htaccess protected MySQL dump files in a backup directory. This directory does only prevent HTTP...