CVE-2014-0943: Improper Input Validation

IBM WebSphere Commerce 6.0 Feature Pack 2 through Feature Pack 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through Feature Pack 7 allows remote attackers to cause a denial of service resource consumption and daemon crash via a malformed id parameter in a request...

PT-2014-3961

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.0 Feature Pack 2 through Feature Pack 5 IBM WebSphere Commerce versions 7.0.0.0 through 7.0.0.8 IBM WebSphere Commerce versions 7.0 Feature Pack 1 through Feature Pack 7 Description The issue allows remote...

Coinbase: Simultaneous Session Logon : Improper Session Management

Hi, I would like to report this bug related to improper simultaneous logon. Issue: 1 When a user is logged in to the application already authenticated, visits the login page https://coinbase.com/signin he/she should directly get redirected to their home page as there is already a session running...

CVE-2014-2736

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...

PT-2014-4854

Name of the Vulnerable Software and Affected Versions MobFox mAdserve versions 2.0 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the id parameter to specific API endpoints, including "edit ad unit.php", "view...

CVE-2014-2654: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MobFox mAdserve 2.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 editadunit.php, 2 viewadunits.php, or 3 editcampaign.php in www/cp/...

PT-2014-2461

Name of the Vulnerable Software and Affected Versions Mingle Forum plugin versions prior to 1.0.34 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a viewtopic action, such as remove post, sticky, or closed, or the threa...

CVE-2013-0735: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic 1 removepost, 2 sticky, or 3 closed action or 4 thread parameter in a postreply action to...

Directory traversal

Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter...

PT-2014-2605

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 3.7.8.2 Description The issue allows remote attackers to read arbitrary files. This is achieved via the id parameter in the patience.cgi component. Recommendations For versions prior to 3.7.8.2, update to...

CVE-2013-2641: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter...

PT-2014-2589

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware G 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/log to net.html or 2 kind parameter to fax/copy settings.html, a different vulnerability than...

CVE-2013-2507: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware G 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/logtonet.html or 2 kind parameter to fax/copysettings.html, a different vulnerability than...

Sql injection

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a 1 getUploadPath or 2 getKBot SOAP request to service/kbotservice.php; the ID parameter to...

CVE-2014-0794: Improper Neutralization of Input During Web Page Generation

SQL injection vulnerability in the JV Comment comjvcomment component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php...

PT-2014-3847

Name of the Vulnerable Software and Affected Versions Joomla! component JV Comment com jvcomment versions prior to 3.0.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in a comment.like action to index.php...

CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

CVE-2014-1636

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

CVE-2014-1636: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to 1 adminschoolnames.php, 2 adminsubjects.php, 3 admingrades.php, 4 adminterms.php, 5 adminschoolyears.php, 6...

PT-2014-4266

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01 Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to various PHP files, including "admin school names.php", "admin...