[CVE-2010-0432] Apache OFBiz Multiple XSS Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Apache OFBiz 1. Advisory Information Title: Multiple XSS in Apache OFBiz Advisory ID: BONSAI-2010-0103 Advisory URL:...

Apache OFBiz Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Apache OFBiz 1. Advisory Information Title: Multiple XSS in Apache OFBiz Advisory ID: BONSAI-2010-0103 Advisory URL:...

Eshbel Priority MarketGate Cross Site Scripting

========================================= Yaniv Miron aka "Lament" Advisory Feb 27, 2010 Eshbel Priority MarketGate module Cross Site Scripting Vulnerability ========================================= ===================== I. BACKGROUND ===================== Priority’s ERP The features listed belo...

Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Eshbel Priority MarketGate module Cross Site Scripting Vulnerability ==================================================================== ===================== I...

Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

========================================= Yaniv Miron aka "Lament" Advisory Feb 27, 2010 Eshbel Priority MarketGate module Cross Site Scripting Vulnerability ========================================= ===================== I. BACKGROUND ===================== Priority’s ERP The features listed belo...

SQL-Ledger ERP多个输入验证和绕过安全限制漏洞

BUGTRAQ ID: 37431 CVECAN ID: CVE-2009-3581,CVE-2009-3582,CVE-2009-3583,CVE-2009-3584 SQL-Ledger ERP是一个企业财务和ERP系统。 SQL-Ledger中的多个安全漏洞允许攻击者执行跨站请求伪造、跨站脚本或SQL注入攻击，或绕过某些安全限制。 1 SQL-Ledger没有执行任何有效性检查便允许用户通过HTTP请求执行某些操作。 2 由于没有正确地过滤提交给Accounts Receivables的客户名称、厂商名称和DCN描述字段，以及提交给Accounts...

Opentaps ERP + CRM Default Credentials (HTTP)

Opentaps ERP + CRM is using known default credentials. SPDX-FileCopyrightText: 2009 Christian Eric Edjenguele Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

Opentaps ERP + CRM Search_String Parameter HTML Injection Vulnerability

The running Opentaps ERP + CRM is prone to an HTML injection vulnerability. SPDX-FileCopyrightText: 2009 Christian Eric Edjenguele Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CP...

Opentaps ERP + CRM Detection

The remote host is running Opentaps ERP + CRM. Opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including: - Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework - Pentaho and JasperReports for business intelligence - Funambol...

Opentaps ERP + CRM service detection

The remote host is running Opentaps ERP + CRM. opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework; Pentaho and JasperReports for business intelligence; Funambol for...

[security bulletin] HPSBTU02382 SSRT080132 rev.1 - HP Secure Web Server for Tru64 UNIX or Internet Express for Tru64 UNIX running PHP, Remote Denial of Service (DoS) or Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01599836 Version: 1 HPSBTU02382 SSRT080132 rev.1 - HP Secure Web Server for Tru64 UNIX or Internet Express for Tru64 UNIX running PHP, Remote Denial of Service DoS or Arbitrary Code Execution...

LedgerSMB 1.2.15之前版本存在多个漏洞

BUGTRAQ ID: 31109 CNCAN ID：CNCAN-2008091102 LedgerSMB是一款开源的ERP系统。 LedgerSMB存在多个输入验证问题，远程攻击者可以利用漏洞消耗大量资源，破坏应用程序或访问修改数据。 1，CGI脚本从$ENVCONTENTLENGTH中读取查询字符串，允许POST大量数据而导致拒绝服务攻击，此漏洞无需验证。 2，AR/AP事务报告存在SQL注入，在生成报告时对参数缺少充分过滤，可导致任意SQL注入到查询中。 LedgerSMB LedgerSMB 1.2.8 LedgerSMB LedgerSMB 1.2.7 LedgerSMB...

[DSECRG-08-002] Local File Include in arias 0.99-6

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public...

DSECRG-08-002.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 - page Local File Inclusion

Aria 0.99-6 - page Local File Inclusion Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of...

Aria 0.99-6 - 'page' Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================ Aria 0.99-6 effect.php page Local File Inclusion Vulnerability ================================================================ Digital Security Research Group DSecRG Advisor...

CVE-2003-1383

WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password...

CVE-2003-1383: Undefined Security Weakness

WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password...