CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

CVE-2013-3515

CVE-2013-3515 affects OpenX OpenX Source 2.8.10 and earlier with two XSS vectors: (1) package parameter in /www/admin/plugin-index.php and (2) group parameter in /www/admin/plugin-settings.php. The root cause is insufficient filtration of user-supplied data, allowing remote attackers to execute a...

Multiple Vulnerabilities in OpenX

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

OpenX 2.8.10 - Multiple Vulnerabilities

OpenX 2.8.10 - Multiple Vulnerabilities Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion...

OpenX 2.8.10 - Multiple Vulnerabilities

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

OpenX 2.8.10 Cross Site Scripting / Local File Inclusion Vulnerabilities

OpenX version 2.8.10 suffers from cross site scripting and local file inclusion vulnerabilities. Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP...

OpenX 2.8.10 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

Multiple Vulnerabilities in OpenX

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to execute arbitrary PHP code, perform Cross-Site Scripting XSS attacks and compromise vulnerable system. 1 Local File Inclusion in OpenX: CVE-2013-3514 Input passed via "group" HTTP GET...

CVE-2012-4990

SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids parameter in a link action...

CVE-2012-4989

Cross-site scripting XSS vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject arbitrary web script or HTML via the parent parameter in an info action...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject arbitrary web script or HTML via the parent parameter in an info action...

Sql injection

SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids parameter in a link action...

CVE-2012-4990

SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids parameter in a link action...

CVE-2012-4990

CVE-2012-4990 : OpenX 2.8.10 (and earlier) is vulnerable to SQL injection via the ids[] parameter in admin/campaign-zone-link.php. The vulnerability allows remote attackers to manipulate SQL queries, with PoCs showing crafted ids[] input and an exploit requiring the attacker to be registered with...

CVE-2012-4989

Cross-site scripting XSS vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject arbitrary web script or HTML via the parent parameter in an info action...

CVE-2012-4989

OpenX 2.8.10 and earlier versions are vulnerable to a Cross‑Site Scripting (XSS) in admin/plugin-index.php via the parent parameter in the info action (CVE-2012-4989). The root cause is unsanitized input returned to the administrator’s browser. Vendor fixed it in SVN revision 81823 (solution file...

Multiple vulnerabilities in OpenX

Advisory ID: HTB23116 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: September 19, 2012 Public Disclosure: October 10, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References: CVE-2012-4989,...

OpenX 2.8.10 Cross Site Scripting / SQL Injection

Advisory ID: HTB23116 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: September 19, 2012 Public Disclosure: October 10, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References: CVE-2012-4989,...

OpenX 2.8.10 - plugin-index.php Cross-Site Scripting

OpenX 2.8.10 - plugin-index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55860/info OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could...

OpenX 2.8.10 - 'plugin-index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/55860/info OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authenticatio...