Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Event Manager eventmanagement, Game Article DB gamearticledb, Simple career mlcareer, Surprise Calendar mlsurprisecalendar, Search Api Ajax Google searchajaxgoogle, Download Manager sprdownloadmanager Release...

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

Title ----- DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability Severity -------- Medium Date Discovered --------------- November 19, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Rob Kraus, Chris Graham and r@b13$ Vulnerability Description...

Information disclosure in FreePBX 2.5.x

Exploit for unknown platform in category web applications ======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class:...

FreePBX 2.5.1 - SQL Injection

FreePBX 2.5.1 - SQL Injection Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running...

FreePBX 2.5.1 - SQL Injection

Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running FreePBX 2.5.1 Local / Remote:...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: MK-AnydropdownMenu mkanydropdownmenu, Photo Book gooffotoboek, SB Folderdownload sbfolderdownload, Developer log devlog, KJ: Imagelightbox kjimagelightbox2, Unit Converter cs2unitconv, powermail powermail, TV21...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Car car, TYPO3 Watchdog abawatchdog, File list drblob, ListMan nllistman, XDS Staff List xdsstaff, Document Directorys danpdocumentdirs, Random Prayer Version 2 steprayer2, Diocese of Portsmouth Resources...

Achievo 1.4.2 Arbitrary File Upload

Exploit for unknown platform in category web applications =================================== Achievo 1.4.2 Arbitrary File Upload =================================== Affected Applications: Confirmed in Achievo 1.4.2. Other versions may also be affected. Severity: Medium – CVSS: 6.8...

Achievo 1.4.2 - Persistent Cross-Site Scripting

Affected Platforms: Any running Achievo Severity: Medium – CVSS: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Vendor Status: New release available Achievo 1.4.3 Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerabilitypolicy.pdf Vulnerability Description: A permanent Cross Site Scriptin...

jetty 6.x 7.x - Cross-Site Scripting Information Disclosure Injection

jetty 6.x 7.x - Cross-Site Scripting Information Disclosure Injection Jetty 6.x and 7.x Multiple Vulnerabilities Name Multiple Vulnerabilities in Jetty Systems Affected Jetty 7.0.0 and earlier versions Severity Medium Impact CVSSv2 Medium 5/10, vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Vendor...

Living CMS Cross-Site Scripting vulnerability

---------------------------------------------------------------------- PT-2009-15 Positive Technologies Security Advisory Living CMS Cross-Site Scripting vulnerability ---------------------------------------------------------------------- --- Affected Software Living CMS Versions prior to 1.5...

Symantec Security Expressions Cross-site Scripting and HTML Injection Vulnerability

SUMMARY Symantecs SecurityExpressions Audit and Compliance Server is susceptible to a cross-site scripting and HTML injection vulnerability. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- SecurityExpressions Audit and Compliance Server | 4.1 4.1.1 | 4.1.1 KB49452 Hotfix 1 Note:...

Orion Application Server Cross Site Scripting

R08-08: Several XSS on Orion Application server 2.0 to 2.0.8 Vulnerability found: May 2008 Revalidated 23 July 2009 Vendor informed: 27th July 09 Vulnerability fixed: Severity: Medium Description: Various Orion application application server example pages are vulnerable to XSS. Orion application...

Windows Vista/7 SMB2.0 Negotiate Protocol Request Remote BSOD Vuln

Exploit for unknown platform in category dos / poc ================================================================== Windows Vista/7 SMB2.0 Negotiate Protocol Request Remote BSOD Vuln ================================================================== =============================================...

Vanilla 1.1.7 Cross Site Scripting

Author: Gerendi Sandor Attila Original advisory: http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html Date: May 14, 2009 Package: Vanilla 1.1.7 Product Homepage: http://getvanilla.com/ Versions Affected: v.1.1.7, 1.1.5 Other versions may also be affected Severity: Medium Inpu...

DDIVRT-2009-25 IPsession SQL Injection Vulnerability

Title ----- DDIVRT-2009-25 IPsession SQL Injection Vulnerability Severity -------- Medium Date Discovered --------------- March 31, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: David Marshall and r@b13$ Vulnerability Description...

Claroline 1.8.11 Cross Site Scripting

Author: Gerendi Sandor Attila Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html Date: May 05, 2009 Package: Claroline 1.8.11 Product Homepage: http://www.claroline.net/ Versions Affected: v.1.8.11 Other versions may also be affected Severity: Medium...

Coppermine Photo Gallery 1.4.21 XSS

Coppermine Photo Gallery 1.4.21 Cross-Site Scripting Author: Gerendi Sandor Attila Date: April 29, 2009 Package: Coppermine Photo Gallery cpg1.4.21 Product homepage: http://coppermine-gallery.net/ Versions Affected: v.1.4.21 older versions are also affected Advisory:...

[Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities

---------------------------------------------------------------------- PT-2009-01 Positive Technologies Security Advisory PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities ---------------------------------------------------------------------- --- Affected Software PGP Desktop 9.9.0...

Multiple vulnerabilities in TYPO3 third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "Accessibility Glossary" a21glossary, "Calendar Base" cal, "Flat Manager" flatmgr Release Date: March 05, 2009 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with...