eyeOS 1.9.0.2 Cross Site Scripting

Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. -...

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files

Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. -...

eyeOS 1.9.0.2 - Image File Handling HTML Injection

eyeOS 1.9.0.2 - Image File Handling HTML Injection source: https://www.securityfocus.com/bid/47629/info eyeOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input passed through image content before using it in dynamically generated content...

eyeOS 1.9.0.2 - Image File Handling HTML Injection

source: https://www.securityfocus.com/bid/47629/info eyeOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input passed through image content before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the...

EyeOS file Parameter Directory Traversal

The version of EyeOS hosted on the remote host includes a PHP script, devtools/qooxdoo-sdk/framework/source/resource/qx/test/part/delay.php, that fails to sanitize input to the 'file' parameter before using it to return the contents of a file from the remote host. An unauthenticated, remote...

Directory traversal

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1714

Cross-site scripting XSS vulnerability in framework/source/resource/qx/test/jsonpprimitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

CVE-2011-1715

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1714

The vulnerability is an XSS in QooxDoo’s jsonp_primitive.php (framework/source/resource/qx/test/jsonp_primitive.php) affecting QooxDoo 1.3 and possibly other versions, as used by eyeOS 2.2/2.3. The underlying issue is reflected script injection via the callback parameter. Current documents do not...

CVE-2011-1715

CVE-2011-1715 describes a directory traversal vulnerability in EyeOS-integrated QooxDoo components (notably the file devtools/qooxdoo-sdk/framework/source/resource/qx/test/part/delay.php). The flaw allows remote attackers to read arbitrary files by supplying encoded dot-dot sequences in the file ...

eyeOS 2.3 Multiple Vulnerabilities

Exploit for php platform in category web applications ------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discover...

eyeos 2.3 - Multiple Vulnerabilities

eyeos 2.3 - Multiple Vulnerabilities ------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery...

eyeOS 2.3 Local File Inclusion

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested On...............Windo...

eyeOS 2.3 Cross Site Scripting

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Reflected Cross-site Scripting Threat Level............Low 1/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested...

eyeos 2.3 - Multiple Vulnerabilities

------------------------------------------------------------------------ Software................eyeOS 2.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.eyeos.org/ Discovery Date..........4/3/2011 Tested On...............Windo...

FreeBSD Ports: eyeOS

The remote host is missing an update to the system as announced in the referenced advisory. VID d3527663-4ccb-11db-b48d-00508d6a62df OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: eyeOS

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

EyeOS <= 0.8.9 Command Execution Vulnerability

The remote system contains a PHP application that is prone to command execution flaws. Description : The remote system is running a vulnerable version of eyeOS. EyeOS is a web based operating system, which makes it possible to access data and applications remote by using a web-browser. The...

EyeOS <= 0.8.9 Command Execution Vulnerability

The installed version of EyeOS does not initialize user sessions properly, allowing unauthenticated attackers to execute arbitrary commands with the privileges of the webserver. SPDX-FileCopyrightText: 2008 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and ar...

eyeOS cross-site scripting vulnerability

Overview eyeOS, an open source web desktop environment Web OS, contains a cross-site scripting vulnerability. This vulnerability has been addressed in eyeOS 0.9.0 and later. Other vulnerabilities are also addressed in the latest version. We recommend that the users upgrade to the latest version...