CVE-2012-4392

The vulnerability CVE-2012-4392 affects ownCloud Server versions earlier than 4.0.7, where index.php fails to properly validate the oc_token cookie, enabling remote attackers to bypass authentication with a crafted cookie. Multiple connected sources corroborate the authentication bypass issue and...

CVE-2012-4395

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

CVE-2012-4392

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

PT-2012-5369

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect url parameter in the index.php...

PT-2012-5366

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7 Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value. Recommendations For ownClo...

CVE-2012-4392: Improper Authentication

index.php in ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value...

CVE-2012-4395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirecturl parameter...

CVE-2012-1614: Exposure of Sensitive Information to an Unauthorized Actor

Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via 1 a direct request to plugins/visiblehookpoints/index.php, an invalid 2 page or 3 cat parameter to thumbnails.php, an invalid 4 page parameter to usermgr.php, or an invalid 5 newerthan or 6 oldertha...

PT-2012-3383

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20 Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

PT-2012-2121

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.3.20 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters. Specifically, the tf name, tf delegation, and tf ip parameters to the...

PT-2012-2120

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.4.0-rc13 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. The vulnerable parameters include tf delegation, tf...

CVE-2011-4951: Undefined Security Weakness

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...

PT-2012-2119

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.4.0-rc13 and earlier Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the module parameter in an "export page" action. This is a...

PT-2012-2123

Name of the Vulnerable Software and Affected Versions Open Business Management versions 2.4.0-rc13 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via various parameters in different PHP files, including sel domain id or...

CVE-2011-5143: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

PT-2012-2118

Name of the Vulnerable Software and Affected Versions DiY-CMS blog module version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the start parameter to various API endpoints, including "tags.php", "list.php", "index.php", "main index.php"...