OneOrZero AIMS 'index.php' Cross Site Scripting Vulnerability

OneOrZero AIMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker t...

OneOrZero AIMS - index.php Cross-Site Scripting

OneOrZero AIMS - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/51549/info OneOrZero AIMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in t...

OneOrZero AIMS - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/51549/info OneOrZero AIMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the contex...

OneOrZero AIMS 2.8.0 Trial Build 231211 Cross Site Scripting

Advisory ID: HTB23066 Reference: https://www.htbridge.ch/advisory/xssinoneorzeroaims.html Product: OneOrZero AIMS Vendor: www.oneorzero.com http://www.oneorzero.com/ Vulnerable Version: 2.8.0 Trial build231211 and probably prior Tested Version: 2.8.0 Trial build231211 Vendor Notification: 28...

XSS in OneOrZero AIMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in OneOrZero AIMS, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in OneOrZero AIMS: CVE-2012-0989 Input appended to the URL after index.php is not properly sanitised...

[PT-2011-20] Authorization bypass vulnerability in OneOrZero AIMS

---------------------------------------------------------------------- PT-2011-20 Positive Technologies Security Advisory Authorization bypass vulnerability in OneOrZero AIMS ---------------------------------------------------------------------- ---Vulnerable software OneOrZero AIMS Version: 2.7....

[PT-2011-21] SQL injection vulnerability in OneOrZero AIMS

---------------------------------------------------------------------- PT-2011-21 Positive Technologies Security Advisory SQL injection vulnerability in OneOrZero AIMS ---------------------------------------------------------------------- ---Vulnerable software OneOrZero AIMS Version: 2.7.0 and...

CVE-2011-4214

OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie...

Authentication flaw

OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie...

CVE-2011-4215

OneOrZero AIMS (OneOrZero AIMS 2.7.0) is affected by CVE-2011-4215 due to an SQL injection in lib/ooz_access.php where the cookieName parameter enables remote attackers to execute arbitrary SQL commands. This vulnerability is described across multiple sources (NVD entry and OpenVAS tests) with a ...

CVE-2011-4215

SQL injection vulnerability in lib/oozaccess.php in OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable...

CVE-2011-4214

OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie...

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

OneOrZero AIMS is prone to a security-bypass vulnerability and an SQL- injection vulnerability. An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions, bypass filtering, and modify the logic of SQL queries. OneOrZero AIMS 2.7.0 is affected; othe...

OneOrZero AIMS Security Bypass and SQLi Vulnerabilities

OneOrZero AIMS is prone to a security bypass vulnerability and an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

OneOrZero AIMS authentication bypass and SQLi vulnerabilities

Overview OneOrZero Action & Information Management System AIMS is vulnerable to an authentication bypass and SQL injection. Description According to the vendor's website:"OneOrZero AIMS is a powerful enterprise ready suite that includes a help desk, knowledge base, time manager and reporting syst...

CVE-2010-4835

Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a showreport action...

CVE-2010-4834

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the 1 id parameter in a savedsearch action and 2 itemtypes parameter in a showitemsearch action in the...

CVE-2010-4835

Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a showreport action...

CVE-2010-4834

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the 1 id parameter in a savedsearch action and 2 itemtypes parameter in a showitemsearch action in the...

CVE-2010-4834

The CVE-2010-4834 entry describes multiple SQL injection flaws in index.php for OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition. The vulnerabilities reside in the search_management_manage subcontroller, where remote authenticated users can manipulate the (1) id parameter in a saved_s...