Fat Player 0.6b - WAV File Processing Buffer Overflow (SEH)

No description provided by source. Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information. Reference:...

[The Sleuth Kit] Library and collection of command line tools to investigate disk images

The Sleuth Kit is a C++ library and collection of open source file system forensics tools that allow you to, among other things, view allocated and deleted data from NTFS, FAT, FFS, EXT2, Ext3, HFS+, and ISO9660 images. The Sleuth Kit® TSK is a library and collection of command line tools that...

CVE-2013-7225

Multiple SQL injection vulnerabilities in app/controllers/homecontroller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the homepage timeline feature or 2 the activity feature...

CVE-2013-7222

config/initializers/secrettoken.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secrettoken value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code...

CVE-2013-7223

Multiple cross-site request forgery CSRF vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protectfromforgery line in app/controllers/applicationcontroller.rb...

Sql injection

Multiple SQL injection vulnerabilities in app/controllers/homecontroller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the homepage timeline feature or 2 the activity feature...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protectfromforgery line in app/controllers/applicationcontroller.rb...

CVE-2013-7223

Multiple cross-site request forgery CSRF vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protectfromforgery line in app/controllers/applicationcontroller.rb...

CVE-2013-7249

CVE-2013-7249 affects Fat Free CRM prior to 0.12.1. The issue is an XML serialization restriction flaw that allows remote attackers to obtain sensitive information via a direct request (e.g., /users/1.xml). This is explicitly described as a separate vulnerability from CVE-2013-7224. The available...

CVE-2013-7224

Fat Free CRM before 0.12.1 is vulnerable due to unrestricted JSON serialization, allowing remote attackers to obtain sensitive information via a direct request (e.g., /users/1.json). This is supported by multiple sources in connected documents. The issue has a confirmed fix; upgrading to 0.12.1 (...

CVE-2013-7222

The CVE concerns Fat Free CRM before 0.12.1, where config/initializers/secret_token.rb defined FatFreeCRM::Application.config.secret_token with a fixed value. This static token allows remote attackers to spoof signed cookies by referencing the key in the source code. Documented in multiple source...

CVE-2013-7223

CVE-2013-7223 affects Fat Free CRM prior to 0.12.1, where CSRF protections were incomplete due to a missing protect_from_forgery line in app/controllers/application_controller.rb. This allowed remote attackers to hijack user sessions via unspecified vectors. The vulnerability is documented across...

CVE-2013-7225

Multiple SQL injection vulnerabilities in app/controllers/homecontroller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the homepage timeline feature or 2 the activity feature...

CVE-2013-7225

CVE-2013-7225 affects Fat Free CRM (Ruby gem) prior to version 0.12.1. The vulnerability is a SQL injection in app/controllers/home_controller.rb that allows remote authenticated users to execute arbitrary SQL commands via the homepage timeline feature or the activity feature. Public references i...

CVE-2013-7249

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224...

CVE-2013-7222

config/initializers/secrettoken.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secrettoken value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code...

Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations

Fat Free CRM contains a flaw that is triggered when the attacker sends a direct request for XML data. This may allow a remote attacker to gain access to potentially sensitive information...

Fat Free CRM Gem for Ruby contains multiple cross-site request forgery (CSRF) vulnerabilities

Fat Free CRM contains a flaw as the application is missing the protectfromforgery statement, therefore HTTP requests to app/controllers/applicationcontroller.rb do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user in...

Fat Free CRM CSRF / SQL Injection / Known Secret

To whom it may concern: A rather informal advisory on Fat Free CRM http://fatfreecrm.com/: Timeline: Aug 27th 2013 Initial email containing the findings listed below including a note that there more vulnerabilities which just need to be verified. Send to [email protected] and...

Fat Free CRM Gem for Ruby allows remote attackers to inject or manipulate SQL queries

Fat Free CRM contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the app/controllers/homecontroller.rb script not properly sanitizing user-supplied input to the 'state' parameter or input passed via comments and emails. This may allow a remote attacker to inje...