Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Eshbel Priority MarketGate module Cross Site Scripting Vulnerability ==================================================================== ===================== I...

Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

========================================= Yaniv Miron aka "Lament" Advisory Feb 27, 2010 Eshbel Priority MarketGate module Cross Site Scripting Vulnerability ========================================= ===================== I. BACKGROUND ===================== Priority’s ERP The features listed belo...

SQL-Ledger ERP多个输入验证和绕过安全限制漏洞

BUGTRAQ ID: 37431 CVECAN ID: CVE-2009-3581,CVE-2009-3582,CVE-2009-3583,CVE-2009-3584 SQL-Ledger ERP是一个企业财务和ERP系统。 SQL-Ledger中的多个安全漏洞允许攻击者执行跨站请求伪造、跨站脚本或SQL注入攻击，或绕过某些安全限制。 1 SQL-Ledger没有执行任何有效性检查便允许用户通过HTTP请求执行某些操作。 2 由于没有正确地过滤提交给Accounts Receivables的客户名称、厂商名称和DCN描述字段，以及提交给Accounts...

Opentaps ERP + CRM Default Credentials (HTTP)

Opentaps ERP + CRM is using known default credentials. SPDX-FileCopyrightText: 2009 Christian Eric Edjenguele Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

Opentaps ERP + CRM Search_String Parameter HTML Injection Vulnerability

The running Opentaps ERP + CRM is prone to an HTML injection vulnerability. SPDX-FileCopyrightText: 2009 Christian Eric Edjenguele Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CP...

Opentaps ERP + CRM service detection

The remote host is running Opentaps ERP + CRM. opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework; Pentaho and JasperReports for business intelligence; Funambol for...

Opentaps ERP + CRM Detection

The remote host is running Opentaps ERP + CRM. Opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including: - Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework - Pentaho and JasperReports for business intelligence - Funambol...

[security bulletin] HPSBTU02382 SSRT080132 rev.1 - HP Secure Web Server for Tru64 UNIX or Internet Express for Tru64 UNIX running PHP, Remote Denial of Service (DoS) or Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01599836 Version: 1 HPSBTU02382 SSRT080132 rev.1 - HP Secure Web Server for Tru64 UNIX or Internet Express for Tru64 UNIX running PHP, Remote Denial of Service DoS or Arbitrary Code Execution...

LedgerSMB 1.2.15之前版本存在多个漏洞

BUGTRAQ ID: 31109 CNCAN ID：CNCAN-2008091102 LedgerSMB是一款开源的ERP系统。 LedgerSMB存在多个输入验证问题，远程攻击者可以利用漏洞消耗大量资源，破坏应用程序或访问修改数据。 1，CGI脚本从$ENVCONTENTLENGTH中读取查询字符串，允许POST大量数据而导致拒绝服务攻击，此漏洞无需验证。 2，AR/AP事务报告存在SQL注入，在生成报告时对参数缺少充分过滤，可导致任意SQL注入到查询中。 LedgerSMB LedgerSMB 1.2.8 LedgerSMB LedgerSMB 1.2.7 LedgerSMB...

[DSECRG-08-002] Local File Include in arias 0.99-6

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public...

DSECRG-08-002.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 - 'page' Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================ Aria 0.99-6 effect.php page Local File Inclusion Vulnerability ================================================================ Digital Security Research Group DSecRG Advisor...

Aria 0.99-6 - page Local File Inclusion

Aria 0.99-6 - page Local File Inclusion Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of...

CVE-2003-1383

WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password...

CVE-2003-1383: Undefined Security Weakness

WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password...

[security bulletin] HPSBTU02179 SSRT061256 rev.1 - HP Tru64 UNIX Running the ps command, Local Disclosure of Sensitive Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00817515 Version: 1 HPSBTU02179 SSRT061256 rev.1 - HP Tru64 UNIX Running the ps command, Local Disclosure of Sensitive Information NOTICE: The information in this Security Bulletin should be acte...

LedgerSMB/SQL-Ledger login本地文件包含和验证绕过漏洞

SQL-Ledger/LedgerSMB是开源的ERP系统。 SQL-Ledger/LedgerSMB不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是'am.pl'脚本对用户提交的'login'参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户访问，可导致获得目标用户敏感信息。 SQL-Ledger SQL-Ledger 2.6.26 SQL-Ledger SQL-Ledger 2.6.25 SQL-Ledger SQL-Ledger 2.6.21 SQL-Ledger SQL-Ledger 2.6.19 SQL-Ledger SQL-Ledge...

SQL-Ledger验证绕过漏洞

SQL-Ledger是一款开源的ERP系统。 SQL-Ledger验证机制实现存在错误，远程攻击者可以利用漏洞未授权访问应用程序。 SQL-Ledger使用的会话验证存在问题，当用户登录时，会检查密码信息，如果匹配users/members文件中的内容，那么就生成会话ID并在WEB浏览器上处理。验证所需只要简单在COOKIE中指定"sql-ledger-username"名和timestamp值，并且这个值匹配通过GET或POST操作传递的"sessionid"值。username是登录的用户名，timestamp是UNIX时间戳。 SQL-Ledger = 2.6.17...