PT-2012-5553 · I Gen · I-Gen Oplynx Central

Name of the Vulnerable Software and Affected Versions: i-GEN opLYNX Central application versions prior to 2.01.9 Description: The issue allows remote attackers to bypass authentication by exploiting a weakness related to the disabling of browser JavaScript support. Recommendations: For versions...

PT-2012-5594

Name of the Vulnerable Software and Affected Versions IBM Rational Automation Framework RAF versions 3.x through 3.0.0.5 Description The issue allows remote attackers to bypass intended access restrictions in the Env Gen Wizard by visiting specific context roots in HTTP sessions on port 8080...

CVE-2012-4816: Undefined Security Weakness

IBM Rational Automation Framework RAF 3.x through 3.0.0.5 allows remote attackers to bypass intended Env Gen Wizard aka Environment Generation Wizard access restrictions by visiting context roots in HTTP sessions on port 8080...

That’s a Wrap! Highlights from MIRcon 2012

Three years ago when we set out to create a conference that would bring together the greatest minds in the information security industry, we could not imagine the overwhelmingly positive response and growth MIRcon™ would receive year after year. Our goal for MIRcon is simple: to inform innovators...

CVE-2012-2105

Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

Sql injection

Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

CVE-2012-2105

Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

CVE-2012-2105

Timesheet Next Gen 1.5.2 contains multiple SQL injection vulnerabilities in login.php that allow remote attackers to execute arbitrary SQL commands through the username or password parameters. This CVE entry is supported by NVD/NVD-derived records and multiple references. No remediation or fix de...

CVE-2012-2105: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters...

PT-2012-3811

Name of the Vulnerable Software and Affected Versions Timesheet Next Gen version 1.5.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username or password parameters in the login.php file. Recommendations For Timesheet Next Gen version...

Next Gen CMS XSS Presistent Vulnerability

Exploit for php platform in category web applications Exploit Title: ACTIVE XSS Next Gen CMS Author: mix0x0 Vendor or Software Link: http://ngcms.ru/ Version: 0.9.3 Release SVN880+FIX01 Vulnerable to the field: "title", test blog Exploit test: var t = new Image;...

Timesheet Next Gen 1.5.2 - Multiple SQL Injections

Timesheet Next Gen 1.5.2 - Multiple SQL Injections Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi Date: 02/23/12 Author: G13 Software Link: https://sourceforge.net/projects/tsheetx/ Version: 1.5.2 Category: webapps php Vulnerability The login.php page has multiple SQL injection...

Timesheet Next Gen 1.5.2 SQL Injection

Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi Date: 02/23/12 Author: G13 Software Link: https://sourceforge.net/projects/tsheetx/ Version: 1.5.2 Category: webapps php Vulnerability The login.php page has multiple SQL injection vulnerabilities. Both the 'username' and 'password' parameters...

Timesheet Next Gen 1.5.2 - Multiple SQL Injections

Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi Date: 02/23/12 Author: G13 Software Link: https://sourceforge.net/projects/tsheetx/ Version: 1.5.2 Category: webapps php Vulnerability The login.php page has multiple SQL injection vulnerabilities. Both the 'username' and 'password' parameters...

E-PHP B2B Cross Site Scripting / SQL Injection

/ Name : E-PHP B2B Marketplace Multiple Vulns WebSite : http://www.ephpscripts.com/b2b-trading-portal.php Price : 150 USD Author : Hamza 'MizoZ' N. Email : [email protected] / XSS - genconfirm.php shows the error message of $GET'errmsg' , but it's not protected against XSS - Exploit :...

NSA Director to Head U.S. Cyber Command

The U.S. Senate has approved Lt. Gen. Keith Alexander, director of the National Security Agency, to also head the military’s recently created U.S. Cyber Command. Read the full article. Computerworld...

CVE-2010-1467: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to 1 collectivite.class.php, 2 injection.class.php, 3 utilisateur.class.php, 4 droit.class.php, 5 laboratoire.class.php, 6...

CVE-2009-0417: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the AgaviWebRouting::gennull method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not...

CVE-2009-0417

Cross-site scripting XSS vulnerability in the AgaviWebRouting::gennull method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not...

CVE-2008-4939

apertium 3.0.7 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.lex.cc, b /tmp/.deformat.l, c /tmp/.reformat.l, d /tmp/docxorig, e /tmp/docxsalida.zip, f /tmp/xlsxembed, g /tmp/xlsxorig, and h /tmp/xslxsalida.zip temporary files, related to the 1...