Achievo 1.4.3 - Cross-Site Request Forgery

Achievo 1.4.3 - Cross-Site Request Forgery Advisory Name: Cross Site Request Forgery in Achievo 1.4.3 Internal Cybsec Advisory Id: 2010-08-03 Vulnerability Class: Cross Site Request Forgery Release Date: 2010-Sept-28 Affected Applications: Achievo 1.4.3 other versions may be also vulnerable...

TYPO3 Security Bulletin

It has been discovered that the extension phpMyAdmin phpmyadmin is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 4.8.1 and below Vulnerability Type: Cross-Site Scripting Severit...

JForum 2.08 Cross Site Scripting

Minded Security Labs: Advisory MSA130510 JForum ?s?i\color='"?.?^'"'"?.?/color\ $2 As it's possible to see from the previous code, "color" attribute expects a parameter between single quotes. Jforum does not encode single quotes, so it's possible to a...

MyIT CRM - Multiple Cross-Site Scripting Vulnerabilities

Advisory Name: Multiple Cross-Site Scripting XSS in MyIT CRM Internal Cybsec Advisory Id: 2010-0607-Multiple XSSs in MyIT CRM Vulnerability Class: Reflected Cross-Site Scripting XSS Release Date: Tue Jun 22, 2010 Affected Applications: MyIT CRM ver.0.2.8.1 Affected Platforms: Any running MyIT CRM...

Cybsec Advisory Multiple Cross-Site Scripting (XSS) in MyIT CRM

Exploit for php platform in category web applications =============================================================== Cybsec Advisory Multiple Cross-Site Scripting XSS in MyIT CRM =============================================================== Advisory Name: Multiple Cross-Site Scripting XSS in...

ProCheckUp Security Advisory 2009.16

PR09-16: Juniper Secure Access series Juniper IVE XSS Vulnerability found: 12th October 2009 Severity: Medium Script injection Description: There is a Cross-site Scripting vulnerability on Juniper, IVE web interface. Procheckup has found by making a malformed request to the IVE Web interface...

Interscan Web Security 5.0 - Arbitrary File Upload / Privilege Escalation

Advisory Name: Local Privilege Escalation in InterScan Web Security Virtual Apliance 5.0 Internal Cybsec Advisory Id: 2010-0604 Vulnerability Class: Local Privilege Escalation Release Date: 22-06-2010 Affected Applications: InterScan Web Security Virtual Aplliance 5.0. Other versions may be...

Phreebooks 2.0 - Directory Traversal

Phreebooks 2.0 - Directory Traversal Advisory Name: Directory Traversal in Phreebooks v2.0 Internal Cybsec Advisory Id: Vulnerability Class: Directory Traversal Release Date: 2010-05-26 Affected Applications: Phreebooks v2.0 Affected Platforms: Any running Phreebooks v2.0 Local / Remote: Remote...

Phreebooks 2.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Phreebooks 2.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities Advisory Name: Multiple Permanent Cross-site Scripting in Phreebooks v2.0 Internal Cybsec Advisory Id: Vulnerability Class: Permanent Cross-site Scripting Release Date: 2010-05-26 Affected Applications: Phreebooks v2.0...

McAfee Email Gateway - Web Administration Broken Access Control

Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway formerly IronMail Vulnerability Class: Broken Access Control Release Date: May 19, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1 Local / Remote: Local...

McAfee Email Gateway (formerly IronMail) - Denial of Service

McAfee Email Gateway formerly IronMail - Denial of Service Advisory Name: Denial of Service in McAfee Email Gateway formerly IronMail Vulnerability Class: Denial of Service Release Date: Tue Apr 6, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected Platforms: FreeBSD 6.2 /...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Brainstorming brainstorming, Power Extension Manager chlightem, Sellector.com Widget Integration chsellector, Educator educator, MK Wastebasket mkwastebasket, myDashboard mydashboard, CleanDB nfcleandb, Diocese...

eGroupWare 1.6.002 and eGroupWare premium line 9.1 - Multiple Vulnerabilities

Advisory Name: Remote Command Execution in EGroupware Vulnerability Class: Remote Command Execution Release Date: 2010-03-09 Affected Applications: Confirmed in EGroupware 1.4.001+.002 and 1.6.001+.002. EGroupware Premium Line 9.1 and 9.2 is also affected. Other versions may also be affected...

osTicket 1.6 RC5 - Multiple Vulnerabilities

osTicket 1.6 RC5 - Multiple Vulnerabilities Advisory Name: SQL injection in osTicket Vulnerability Class: SQL injection Release Date: 2010-02-09 Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity:...

osTicket 1.6 RC5 - Multiple Vulnerabilities

Advisory Name: SQL injection in osTicket Vulnerability Class: SQL injection Release Date: 2010-02-09 Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Event Manager eventmanagement, Game Article DB gamearticledb, Simple career mlcareer, Surprise Calendar mlsurprisecalendar, Search Api Ajax Google searchajaxgoogle, Download Manager sprdownloadmanager Release...

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

Title ----- DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability Severity -------- Medium Date Discovered --------------- November 19, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Rob Kraus, Chris Graham and r@b13$ Vulnerability Description...

Information disclosure in FreePBX 2.5.x

Exploit for unknown platform in category web applications ======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class:...

FreePBX 2.5.1 - SQL Injection

FreePBX 2.5.1 - SQL Injection Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running...

FreePBX 2.5.1 - SQL Injection

Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running FreePBX 2.5.1 Local / Remote:...