2733 matches found
IBM Bladecenter Management - Multiple web application vulnerabilities
No description provided by source. DSECRG-09-054 IBM Bladecenter Management - Multiple vulnerabilities The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS Digital Security Research Group DSecRG Advisory DSECRG-09-054...
Dolibarr ERP & CRM OS Command Injection
No description provided by source. Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely Exploitable: Yes...
webERP <= 4.08.4 - WorkOrderEntry.php SQL Injection Vulnerability
No description provided by source. Exploit Title: webERP =4.08.4 WorkOrderEntry.php SQL Injection Vulnerability Date: 14/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.weberp.org Software Link: http://sourceforge.net/projects/web-erp/files/ Version: 4.08.4...
Transform Foundation Server 4.3.1 / 5.2 Cross Site Scripting
I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in Transform Foundation server 4.3.1 and 5.2 from Bottomline Technologies II. BACKGROUND ------------------------- Bottomline offers powerful, next-generation electronic document solutions for formatting, personalizi...
Information disclosure
The Security Audit Log facility in SAP Enhancement Package EHP 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information...
CVE-2014-2748
The Security Audit Log facility in SAP Enhancement Package EHP 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information...
CVE-2014-2748
Technical details about CVE-2014-2748 are not provided in the supplied documents. No concrete information on affected product versions, vulnerable component, root cause, exploit vectors, or fixes is available here. Monitor for updated advisories.
SAP ERP Enhancement Packages安全审核日志数据操作漏洞
Bugtraq ID:66683 SAP ERP Enhancement Packages是一个SAP ERP增强包。 SAP ERP Enhancement Packages相关安全审核日志存在未明错误，允许恶意用户编辑或删除日志数据。 0 SAP ERP Enhancement Packages EHP 6.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://service.sap.com/sap/support/notes/1926485...
FrontAccounting 'attachments.php'任意文件上传漏洞
Bugtraq ID:66217 FrontAccounting FA是一个针对企业ERP供应链的网页会计系统。 FrontAccounting /admin/attachments.php脚本存在安全漏洞，允许攻击者上传使用恶意扩展名的文件，并以WEB权限执行。 0 FrontAccounting 2.x FrontAccounting 2.3.20已经修复该漏洞，建议用户下载更新： http://frontaccounting.com...
DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials
This module will extract user credentials from DoliWamp - a WAMP packaged installer distribution for Dolibarr ERP on Windows - versions 3.3.0 to 3.4.2 by hijacking a user's session. DoliWamp stores session tokens in filenames in the 'tmp' directory. A directory traversal vulnerability in...
CVE-2013-3617
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity XXE iss...
Xxe
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity XXE iss...
CVE-2013-3617
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity XXE iss...
CVE-2013-3617
CVE-2013-3617 affects Openbravo ERP 2.5, 3.0 and earlier. The XML API permits remote authenticated users to read arbitrary files via an XML External Entity (XXE) vulnerability, using an external entity declaration with a reference to internal /ws/dal/ interfaces (e.g., ADUser). Impact: potential ...
Openbravo ERP - XML External Entity Information Disclosure
Openbravo ERP - XML External Entity Information Disclosure source: https://www.securityfocus.com/bid/63431/info Openbravo ERP is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. Openbrav...
Openbravo ERP contains an information disclosure vulnerability
Overview Openbravo ERP 2.5, 3, and possibly earlier versions contain an information disclosure vulnerability CWE-200. Description CWE-200: Information Exposure Openbravo ERP version 2.5 and version 3 contain an information disclosure vulnerability. This is due to the expanded use of XML External...
Openbravo ERP XXE Arbitrary File Read
The Openbravo ERP XML API expands external entities which can be defined as local files. This allows the user to read any files from the FS as the user Openbravo is running as generally not root. This module was tested against Openbravo ERP version 3.0MP25 and 2.50MP6. Module Options msf use...
Openbravo ERP - XML External Entity Information Disclosure
source: https://www.securityfocus.com/bid/63431/info Openbravo ERP is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. Openbravo ERP 2.5 and 3.0 are vulnerable...
Code injection
Unspecified vulnerability in the Statutory Reporting for Insurance FSSR component in the Financial Services module for SAP ERP Central Component ECC allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."...