EUVD-2008-3703

Malware in sbrugna...

EUVD-2008-3702

Malware in sbrugna...

EUVD-2008-3582

Malware in sbrugna...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a 1 save or 2 delete action to an unspecified component...

CVE-2008-3717

Harmoni before 1.6.0 does not require administrative privileges to list 1 user names or 2 asset ids, which allows remote attackers to obtain sensitive information...

CVE-2008-3716

Cross-site request forgery CSRF vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a 1 save or 2 delete action to an unspecified component...

Information disclosure

Harmoni before 1.6.0 does not require administrative privileges to list 1 user names or 2 asset ids, which allows remote attackers to obtain sensitive information...

CVE-2008-3716

CVE-2008-3716 is a CSRF vulnerability in Harmoni prior to 1.6.0 that allows remote attackers to perform administrative modifications via a (1) save or (2) delete action to an unspecified component. The NVD entry lists a base score of 6.0 (Medium) with network attack vector, requiring user interac...

CVE-2008-3716

Cross-site request forgery CSRF vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a 1 save or 2 delete action to an unspecified component...

CVE-2008-3717

Harmoni before 1.6.0 does not require administrative privileges to list 1 user names or 2 asset ids, which allows remote attackers to obtain sensitive information...

CVE-2008-3717

CVE-2008-3717 : The Harmoni application (before version 1.6.0) allows remote attackers to obtain sensitive information by listing (1) user names and (2) asset IDs without requiring administrative privileges. The NVD entry documents a confidentiality impact (partial) with network access and no aut...

Cross site scripting

Cross-site scripting XSS vulnerability in Harmoni before 1.4.7 allows remote attackers to inject arbitrary web script or HTML via the Username field, which is inserted into logs that could be rendered when viewed by an administrator...

CVE-2008-3596

Cross-site scripting XSS vulnerability in Harmoni before 1.4.7 allows remote attackers to inject arbitrary web script or HTML via the Username field, which is inserted into logs that could be rendered when viewed by an administrator...

CVE-2008-3596

The CVE-2008-3596 entry describes a Cross-site Scripting (XSS) vulnerability in Harmoni prior to version 1.4.7. The flaw arises from the Username field, which is logged and could be rendered in an administrator view, enabling remote attackers to inject arbitrary web script or HTML. The available ...

CVE-2008-3596

Cross-site scripting XSS vulnerability in Harmoni before 1.4.7 allows remote attackers to inject arbitrary web script or HTML via the Username field, which is inserted into logs that could be rendered when viewed by an administrator...