Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 Comments.asp FC Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27924/info Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize...

CVE-2014-1455

Pearson eSIS Enterprise Student Information System (vendor Pearson VUE) is affected by CVE-2014-1455 due to an SQL injection in the password-reset function. The vulnerability involves unsanitized input in the new password being used in an ALTER USER/SQL context, enabling an attacker to execute ar...

Pearson eSIS Enterprise Student Information System XSS

Advisory ID: hag201477 Product: Pearson eSIS Enterprise Student Information System Vendor: PearsonVue Vulnerable Versions: Any version Advisory Publication: April 06, 2014 Vendor Notification: March 05, 2014 Public Disclosure: April 06, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

Cross site scripting

Cross-site scripting XSS vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1942

Cross-site scripting XSS vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1942

Pearson eSIS Enterprise Student Information System contains a reflected XSS vulnerability in /aal/loginverification.aspx. The issue allows remote attackers to inject arbitrary script via unspecified vectors, potentially affecting the user’s browser context. The publicly available sources identify...

大汉xxgk（政府信息公开）系统某处越权+getshell

简要描述： 政府信息公开系统的getshell。和前两天发的那个拿shell方式是不一样的。 详细说明： 越权发生在setup/oprsetting.jsp 拿shell是在上传license文件的jsp中setup/oprlicenceinfo.jsp 漏洞证明： 此时已经将setup的登录密码清空。（有风险，请勿随意尝试，不要跟着我犯错……） 提交数据的时候清空密码即可登录成功 img src="https://images.seebug.org/upload/201403/032350491567f745ccbf670be2346bb5147a9878.png"...

Pirate Bay co-founder 'Anakata' suspected of hacking Danish police databases

The Pirate Bay co-founder Gottfrid Svartholm Warg a.k.a 'Anakata' is suspected of being involved in one of Denmark's biggest hack attacks. Gottfrid was arrested in Cambodia in September 2012 and has been extradited from Cambodia to Sweden last year, charged with hacking the IBM mainframe of Logic...

Pirate Bay co-founder 'Anakata' suspected of hacking Danish police databases

The Pirate Bay co-founder Gottfrid Svartholm Warg a.k.a 'Anakata' is suspected of being involved in one of Denmark's biggest hack attacks. Gottfrid was arrested in Cambodia in September 2012 and has been extradited from Cambodia to Sweden last year, charged with hacking the IBM mainframe of Logic...

Student Suspected in University Hack That Leaked Info of 654K Cornhuskers

Officials at the University of Nebraska suspect a current undergraduate student is behind a hack earlier this month that appears to have spilled the sensitive information of tens of thousands of past and present students. According to a report from the Omaha World-Herald today, Police Chief Owen...

Boomerank CMS WebShop-module SQL Injection

Exploit for php platform in category web applications Exploit Title: Boomerank CMS WebShop-module SQL Injection Vuln. Date: 28.03.2012 Google Dork: inurl:"vozicek-dodaj.html?id=" site:.si Author: Mr.5p0ng3 email protected Software Link: www.boomerank.net Author's website Version: All Tested on:...

Lenovo based information distribution system the presence of a CRLF injection/HTTP response splitting-vulnerability warning-the black bar safety net

Brief description: It is a remote attacker to inject custom HTTP headers. The attacker can inject a session cookie or HTML code. This may be theXSS（cross-site scripting or session fixation vulnerability. Detailed description: URL-encoded input langid set SomeCustomInjectedHeader: the injectedbywv...

Care2X Hospital System v2.5.x - Multiple Web Vulnerabilities

Document Title: =============== Care2X Hospital System v2.5.x - Multiple Web Vulnerabilities Release Date: ============= 2011-06-24 Vulnerability Laboratory ID VL-ID: ==================================== 69 Product & Service Introduction: =============================== Integrated Hospital...

Hackers get access to N.J. school data system !

4chan users online bulletin board has been able to access the online information system used by student school district in New Jersey after the administrator password of the school was registered last week 4chan. The trouble began last Tuesday, according to Plainfield Board of Education, which...

Lincoln National: 'Breach May Affect 1.2 Mil Customers'

Lincoln National Corp. LNC last week disclosed a security vulnerability in its portfolio information system that could have compromised the account data of approximately 1.2 million customers. Read the full article. Dark Reading...

Audit Finds Gaping Holes in NASA Security

The U.S. Government Accountability Office GAO has painted a bleak picture of the NASA’s IT security posture. An audit of the space agency’s computer systems found weaknesses in several critical areas, especially in the way NASA implemented access controls like user accounts, passwords and the...

CVE-2008-1548

Multiple cross-site scripting XSS vulnerabilities in Aeries Browser Interface ABI 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the 1 UserName parameter to loginproc.asp and the 2 usr parameter to Login.asp...

CVE-2008-1549

Multiple SQL injection vulnerabilities in Aeries Browser Interface ABI 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the 1 GrdBk parameter to GradebookOptions.asp and the 2 SchlCode variable to loginproc.asp, a different...

Sql injection

Multiple SQL injection vulnerabilities in Aeries Browser Interface ABI 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the 1 GrdBk parameter to GradebookOptions.asp and the 2 SchlCode variable to loginproc.asp, a different...

CVE-2008-1548

CVE-2008-1548 describes multiple XSS vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 within Eagle Software’s Aries Student Information System. The issues allow remote attackers to inject arbitrary web script or HTML via (1) the UserName parameter to loginproc.asp and (2) the usr parame...