CVE-2018-16761

CVE-2018-16761 affects Eventum before 3.4.0, which contains an open redirect vulnerability. The adjacent nuclei template confirms that an attacker can redirect a user to a malicious site, potentially enabling phishing or data exposure. Remediation per sources is to upgrade to Eventum version 3.4....

CVE-2018-16761

Eventum before 3.4.0 has an open redirect vulnerability...

Design/Logic Flaw

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

Code injection

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter...

CVE-2014-1632

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter...

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

CVE-2014-1632

CVE-2014-1632 : In Eventum, vulnerable up to version 2.3.4, the installation script/config handling allows remote code execution via the hostname parameter in /config/config.php during setup. The underlying issue is code injection due to insufficient input sanitization, enabling an attacker with ...

CVE-2014-1632

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter...

CVE-2014-1631

CVE-2014-1631 affects Eventum prior to 2.3.5. The root cause is incorrect default permissions in the installation workflow (setup/index.php) allowing remote reinstall, paired with potential code injection through /config/config.php during setup. Affected versions include Eventum 2.3.4 (and earlie...

MySQL AB Eventum 1.x view.php id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/14436/info MySQL Eventum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issu...

MySQL AB Eventum 1.x get_jsrs_data.php F Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/14436/info MySQL Eventum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issu...

eventum issue tracking system 2.3.1 - Stored XSS

No description provided by source. Exploit Title: Eventum 2.3.1 stored XSS Date: 19-2-2011 Author: Saif El-Sherei Software Link: https://code.launchpad.net/eventum Version: Eventum 2.3.1 Tested on: FF 3.0.15, IE 8 Vendor notification: vendor notified, awaiting response Info: Eventum is a...

MySQL AB Eventum 1.x list.php release Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/14436/info MySQL Eventum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issu...

MySQL Eventum <= 1.5.5 (login.php) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w use IO::Socket; use strict; print \n; print MySQL Eventum = v1.5.5 SQL Injection PoC \n; print James Bercegay // gulftech.org // 7-28-05 \n; print \n; my $host = 'localhost'; my $path = '/eventum/login.php'; my $user = '2'; my $port = 80; my...

Multiple Vulnerabilities in Eventum

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...

Eventum 2.3.4 Incorrect Permissions / Code Injection Vulnerabilities

Eventum version 2.3.4 suffers from incorrect default permission and code injection vulnerabilities. Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22...

Eventum 2.3.4 - hostname Remote Code Execution

Eventum 2.3.4 - hostname Remote Code Execution Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor...

Eventum 2.3.4 - 'hostname' Remote Code Execution

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...

Eventum 2.3.4 Incorrect Permissions / Code Injection

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...