pragmaMx 1.12.1 Cross Site Scripting

Advisory ID: HTB23090 Product: pragmaMx Vendor: pragmaMx Team Vulnerable Versions: 1.12.1 and probably prior Tested Version: 1.12.1 Vendor Notification: 2 May 2012 Vendor Patch: 4 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Cross-Site Scripting XSS CVE Reference: CVE-2012-2452...

pragmaMx 1.12.1 Cross Site Scripting

Exploit for php platform in category web applications Product: pragmaMx Vendor: pragmaMx Team Vulnerable Versions: 1.12.1 and probably prior Tested Version: 1.12.1 Vendor Notification: 2 May 2012 Vendor Patch: 4 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Cross-Site Scripting XSS...

Cross-Site Scripting (XSS) in Pivotx

Advisory ID: HTB23087 Product: Pivotx Vendor: pivotx.net Vulnerable Versions: 2.3.2 and probably prior Tested Version: 2.3.2 Vendor Notification: 18 April 2012 Vendor Patch: 18 April 2012 Public Disclosure: 9 May 2012 Vulnerability Type: Cross-Site Scripting XSS CVE Reference: CVE-2012-2274...

XSS in PrestaShop

High-Tech Bridge SA Security Research Lab has discovered vulnerability in PrestaShop, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in PrestaShop Input passed via the "product" POST parameter to ajax.php is not properly sanitised before being...

PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability

High-Tech Bridge reports: Input passed via the "file" GET parameter to /pivotx/ajaxhelper.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of the affected website...

PluXml 5.1.5 - Local File Inclusion

PluXml 5.1.5 - Local File Inclusion Advisory ID: HTB23086 Product: PluXml Vendor: pluxml.org Vulnerable Versions: 5.1.5 and probably prior Tested Version: 5.1.5 Vendor Notification: 11 April 2012 Vendor Patch: 16 April 2012 Public Disclosure: 2 May 2012 Vulnerability Type: Local File Inclusion CV...

Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...

XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities

XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities Advisory ID: HTB23062 Product: XOOPS Vendor: xoops.org Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability...

newscoop 3.5.3 - Multiple Vulnerabilities

Advisory ID: HTB23084 Product: Newscoop Vendor: Sourcefabric o.p.s. Vulnerable Versions: 3.5.3 and probably prior, partially 4.0 RC3 Tested Version: 3.5.3 Vendor Notification: 28 March 2012 Vendor Patch: 5 April 2012 Public Disclosure: 18 April 2012 Vulnerability Type: Remote File Inclusion, SQL...

Сross-Site Request Forgery (CSRF) in TestLink

High-Tech Bridge Security Research Lab has discovered vulnerabiliy in TestLink, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in TestLink: CVE-2012-2275 The application allows authorized users to perform certain actions via HTTP...

Newscoop 3.5.3 XSS / RFI / SQL Injection

Advisory ID: HTB23084 Product: Newscoop Vendor: Sourcefabric o.p.s. Vulnerable Versions: 3.5.3 and probably prior, partially 4.0 RC3 Tested Version: 3.5.3 Vendor Notification: 28 March 2012 Vendor Patch: 5 April 2012 Public Disclosure: 18 April 2012 Vulnerability Type: Remote File Inclusion, SQL...

XOOPS 2.5.4 Cross Site Scripting

Advisory ID: HTB23062 Product: XOOPS Vendor: xoops.org Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability Type: XSS Cross Site Scripting CVE References: CVE-2012-098...

WordPress All-In-One Event Calendar 1.4 Cross Site Scripting

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...

Multiple vulnerabilities in Open Journal Systems (OJS)

Advisory ID: HTB23079 Product: Open Journal Systems OJS Vendor: Public Knowledge Project Vulnerable Versions: 2.3.6 and probably prior Tested Version: 2.3.6 Vendor Notification: 29 February 2012 Vendor Patch: 16 March 2012 Public Disclosure: 21 March 2012 Vulnerability Type: Arbitrary File...

Multiple vulnerabilities in Elefant CMS

Advisory ID: HTB23076 Product: Elefant CMS Vendor: Elefant CMS Vulnerable Versions: 1.1.3 beta and probably prior Tested Version: 1.1.3 beta Vendor Notification: 22 February 2012 Vendor Patch: 22 February 2012 Public Disclosure: 14 March 2012 Vulnerability Type: SQL Injection, XSS Cross Site...

Multiple XSS in Chyrp

Advisory ID: HTB23073 Product: Chyrp Vendor: Chyrp Vulnerable Versions: 2.5b1 and probably prior Tested Version: 2.5b1 Vendor Notification: 1 February 2012 Vendor Patch: 2 February 2012 Public Disclosure: 22 February 2012 Vulnerability Type: Cross Site Scripting XSS CVE References: CVE-2012-1001...

Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...

Multiple XSS in Dotclear 2.4.1.2

No description provided by source. Advisory ID: HTB23074 Product: Dotclear Vendor: Dotclear Vulnerable Versions: 2.4.1.2 and probably prior Tested Version: 2.4.1.2 Vendor Notification: 8 February 2012 Vendor Patch: 9 February 2012 Public Disclosure: 29 February 2012 Vulnerability Type: Cross Site...

Multiple vulnerabilities in ocPortal

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ocPortal, which can be exploited to perform Cross-Site Scripting XSS and Arbitrary File Disclosure attacks. 1 Multiple Cross-Site Scripting XSS in ocPortal: CVE-2012-1470 1.1 Input passed via the "path" and "line...