Informatica: [kb.informatica.com] Unauthenticated emails and HTML injection in email messages

Hello, The endpoint at https://kb.informatica.com/layouts/infakb/preview/EmailExtended.aspx?docid=anything is vulnerable to unauthenticated emails, which allows attackers to impersonate anyone and send emails on their behalf. Also, the message body field is vulnerable to HTML injection, which...

Informatica: [marketplace.informatica.com] - XXE

Request: POST /api/rest/mpapi/infaMPAPISearchWebService/query HTTP/1.1 Host: marketplace.informatica.com Connection: keep-alive Content-Length: 140 Accept: / X-J-Token: no-user X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

Informatica: [now.informatica.com] Reflective XSS

XSS vulnerability lies on http://now.informatica.com/launch-next-bigdata-registration-inxpo.html?Source=homepage POC Sign up for big data management Virtual launch event on parameter companyname inject '"...

Informatica: XXE in upload file feature

The attacker was able to execute XXE in one of the file upload feature...

Informatica: [app.informaticaondemand.com] XXE

Request: POST /ma/api/v2/user/login HTTP/1.1 Host: app.informaticaondemand.com Content-Length: 285 Content-Type: application/xml Accept: application/xml %asd; %rrr; [email protected] Where xx.html: "%c; Then i got file /etc/passwd xxeapp.png...

Informatica: [rev-app.informatica.com] - XXE

Open file xxe.xlsx like zip-archive 2. Read file xxe.xlsx\xl\worksheets\sheet1.xml In file I wrote XXE payload: Then, i went to https://rev-app.informatica.com and made new project and imported my XLSX-file When it was impoted i see /etc/passwd file: root:x:0:0:root:/root:/bin/bash...

Informatica: [now.informatica.com] Reflective Xss

http://now.informatica.com/endata-integration-for-dummiesbook2642.html?source=Homepage The issue is located here. I will be including a video demonstrating this vulnerability Xss vector used: xs...

Informatica: XSS in Search Communities Function

When you search for a URL on the communities page, you visit a URL that looks like this https://community.informatica.com/community/marketplace/search/?blkCatIds=free+apps&view=solution By replacing the search query with html ";alert0;t=" and making the final URL:...

Informatica: [community.informatica.com] - CSRF in Private Messages allows to move user's messages to Trash

Hello, https://community.informatica.com/pm-delete.jspa doesn't check Referrer header or CSRF token when you move a message to Trash. As a result, an attacker can implement CSRF attack, and make a victim move messages to Trash. Then, according to the message on Trash page...

Informatica: [careers.informatica.com] Cross Site Script Vulnerability on informatica

Information:- Vulnerability resides on the Carriers page of informatica, where search bar of the carrier page failed to sanitized the users query and hence gives the XSS popup. Vulnerable URL:- https://careers.informatica.com/ Payload:- " Steps to Reproduce the Vulnerability 1. Open Carriers page...

Informatica: Missing SPF for informatica.com

Steps to reproduce: Go Here http://www.kitterman.com/spf/validate.html? Then Put informatica.com Then Click Get SPF Records if any then you will got nothing or no records. POC: http://s28.postimg.org/ofksihxyl/spf.png...

Informatica: [mysupport.informatica.com] - reflected XSS

Vulnerability description not provided...

Nic.cl Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Main URI: http://www.nic.cl Type: Cross Site Scripting Exploitable URI: http://www.nic.cl/cgi-bin/show-form?f=/example/201001191941%3Cbody%20onload=alert%28this%29%3E3a6 Status: Reported Date: April 20, 2011, 12:27 p.m. Reported on:...

Directory traversal

Directory traversal vulnerability in the Ternaria Informatica Jfeedback! comjfeedback component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

Directory traversal

Directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-1478

CVE-2010-1478 is a Local File Inclusion vulnerability in the Joomla! component com_jfeedback v1.2 (Ternaria Informatica Jfeedback!). An attacker can read arbitrary files by supplying a .. traversal in the controller parameter to index.php, enabling remote access to sensitive files. The Nuclei tem...

CVE-2010-1469

Summary: CVE-2010-1469 is a directory traversal/local file inclusion vulnerability in the Joomla! component com_jprojectmanager 1.0 for the Joomla! CMS. An attacker can exploit a .. (dot dot) sequence in the controller parameter to index.php to read arbitrary files and potentially impact the appl...

CVE-2010-1469

Directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-1469: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-1478: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Ternaria Informatica Jfeedback! comjfeedback component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...