Kandidat CMS 1.4.2 - Persistent Cross-Site Scripting

Vulnerability ID: HTB22648 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinkandidatcms.html Product: Kandidat CMS Vendor: Kan-Studio http://www.kan-studio.ru/ Vulnerable Version: 1.4.2 and probably prior versions Vendor Notification: 19 October 2010 Vulnerability Type: Stored XSS Cro...

MemHT Portal 4.0.1 - Persistent Cross-Site Scripting

Vulnerability ID: HTB22662 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinmemhtportal.html Product: MemHT Portal Vendor: Miltenovik Manojlo http://www.memht.com/ Vulnerable Version: 4.0.1 and probably prior versions Vendor Notification: 19 October 2010 Vulnerability Type: Stored XSS...

Webmedia Explorer 6.13.1 - Persistent Cross-Site Scripting

Vulnerability ID: HTB22661 Reference: http://www.htbridge.ch/advisory/storedxssvulnerabilityinwebmediaexplorer.html Product: Webmedia Explorer Vendor: Marc Salmurri http://www.webmediaexplorer.com/ Vulnerable Version: 6.13.1 and probably prior versions Vendor Notification: 19 October 2010...

DZCP 1.5.4 Local File Inclusion

Vulnerability ID: HTB22656 Reference: http://www.htbridge.ch/advisory/lfiindzcp.html Product: DZCP Vendor: dzcp.de http://www.dzcp.de Vulnerable Version: 1.5.4 Vendor Notification: 13 October 2010 Vulnerability Type: Local File Inclusion Status: Fixed by Vendor Risk level: High Credit: High-Tech...

Path disclosure in MyBB

Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor Respon...

XSS vulnerability in BlogBird platform

Vulnerability ID: HTB22647 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinblogbird1.html Product: BlogBird Vendor: BlogBird http://www.blogbird.nl/ Vulnerable Version: Current actual version on http://www.blogbird.nl/ Vendor Notification: 13 October 2010 Vulnerability Type: Stored X...

DBHcms 1.1.4 SQL Injection

Vulnerability ID: HTB22651 Reference: http://www.htbridge.ch/advisory/sqlinjectionindbhcms.html Product: DBHcms Vendor: drbenhur.com http://www.drbenhur.com/ Vulnerable Version: 1.1.4 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability Type: SQL Injection Status: Not...

BlogBird Platform Multiple XSS Vulnerabilities

Exploit for php platform in category web applications ============================================== BlogBird Platform Multiple XSS Vulnerabilities ============================================== Product: BlogBird Vendor: BlogBird http://www.blogbird.nl/ Vulnerable Version: Current actual version ...

BlogBird Platform - Multiple Cross-Site Scripting Vulnerabilities

Vulnerability ID: HTB22647 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinblogbird1.html Product: BlogBird Vendor: BlogBird http://www.blogbird.nl/ Vulnerable Version: Current actual version on http://www.blogbird.nl/ Vendor Notification: 13 October 2010 Vulnerability Type: Stored X...

DZCP (deV!L_z Clanportal) 1.5.4 - Local File Inclusion

DZCP deV!Lz Clanportal 1.5.4 - Local File Inclusion Vulnerability ID: HTB22656 Reference: http://www.htbridge.ch/advisory/lfiindzcp.html Product: DZCP Vendor: dzcp.de http://www.dzcp.de Vulnerable Version: 1.5.4 Vendor Notification: 13 October 2010 Vulnerability Type: Local File Inclusion Status:...

XSS vulnerability in sNews

Vulnerability ID: HTB22638 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsnews1.html Product: sNews Vendor: sNews Team tp://www.snewscms.com/ Vulnerable Version: 1.7 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...

sNews CMS - Multiple Cross-Site Scripting Vulnerabilities

sNews CMS - Multiple Cross-Site Scripting Vulnerabilities Vulnerability ID: HTB22638 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsnews1.html Product: sNews Vendor: sNews Team tp://www.snewscms.com/ Vulnerable Version: 1.7 and probably prior versions Vendor Notification: 05 Octobe...

Authentication Bypass Vulnerability in phpLiterAdmin

High-Tech Bridge SA Security Research Lab has discovered vulnerability in phpLiterAdmin which could be exploited to bypass authentication mechanism and gain unauthorized access to the application. 1 Authentication Bypass Vulnerability in phpLiterAdmin The vulnerability exists due to a design erro...

XSS vulnerability in Ronny CMS

Vulnerability ID: HTB22622 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinronnycms.html Product: Ronny CMS Vendor: TO4KA Programming Team http://ronny-cms.ru/ Vulnerable Version: 1.1 r935 and probably prior versions Vendor Notification: 29 September 2010 Vulnerability Type: Stored X...

Cross-site Scripting (XSS) Vulnerability in NinkoBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in NinkoBB which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in NinkoBB: CVE-2010-4874 The vulnerability exists due to input sanitation error in parameters...

Multiple Vulnerabilities in Energine

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Energine which could be exploited to perform cross-site request forgery and SQL injection attacks. 1 Cross-site request forgery CSRF in in Energine The vulnerability exists due to insufficient validation of the...

Local File Inclusion Vulnerability in DZCP

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DZCP which could be exploited to include and execute arbitrary local files on the target system. 1 Local file inclusion in DZCP Input passed to the " prefixlanguage" cookie in index.php is not properly sanitized before bein...

SQL injection vulnerability in Elxis CMS

Vulnerability ID: HTB22613 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinelxiscms.html Product: Elxis CMS Vendor: Elxis Team http://www.elxis.org/ Vulnerable Version: 2009.2 electra rev2631 and probably prior versions Vendor Notification: 20 September 2010 Vulnerability...

XSS vulnerability in Elxis CMS polls module

Vulnerability ID: HTB22616 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinelxiscmspollsmodule.html Product: Elxis CMS Vendor: Elxis Team http://www.elxis.org/ Vulnerable Version: 2009.2 electra rev2631 and probably prior versions Vendor Notification: 20 September 2010 Vulnerability...

SQL Injection Vulnerability in DeluxeBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DeluxeBB which could be exploited to execute arbitrary SQL commands in applications database. 1 SQL injection vulnerability in DeluxeBB: CVE-2010-4151 An input validation error exists in the "xthedateformat" parameter in...