[RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted Cross Site Scripting attacks in its RSS feed reader. If attackers control or compromise an RSS...

IceWarp WebMail Email View XSS

Advisory: IceWarp WebMail Server: Cross Site Scripting in Email View During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to Cross Site Scripting attacks in its email view. This enables attackers to send emails with embedded JavaScript code, for exampl...

Trend micro - IWSVA/IWSS - Authorization module password leak

There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header sends WMP. Requirements: - IWSVA/IWSS basic authorization on - Client is using WMP 8-11 as video player - Standalone proxy if upstream proxy is used,...

Alcatel OmniPCX Office 210/061.1 Remote Command Execution Vuln

Exploit for cgi platform in category web applications ============================================================== Alcatel OmniPCX Office 210/061.1 Remote Command Execution Vuln ============================================================== Digital Security Research Group DSecRG Advisory...

rt-sa-2008-001.txt

Advisory: Remote Command Execution in Mapbender During a penetration test RedTeam Pentesting discovered a remote command execution vulnerability in Mapbender. An unauthorized user can create arbitrary PHP-files on the Mapbender webserver, which can later be executed. Details ======= Product:...

rt-sa-2008-002.txt

Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the Mapbender users. Details =======...

[Full-disclosure] Advisory: SQL-Injections in Mapbender

Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the Mapbender users. Details =======...

[Full-disclosure] Advisory: Remote Command Execution in Mapbender

Advisory: Remote Command Execution in Mapbender During a penetration test RedTeam Pentesting discovered a remote command execution vulnerability in Mapbender. An unauthorized user can create arbitrary PHP-files on the Mapbender webserver, which can later be executed. Details ======= Product:...

Mapbender 2.4.4 (gaz) Remote SQL Injection Vulnerability

No description provided by source. Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the...

Mapbender 2.4.4 (gaz) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================== Mapbender 2.4.4 gaz Remote SQL Injection Vulnerability ======================================================== Advisory: SQL-Injections in Mapbender During a penetration test RedTea...

Mapbender <= 2.4.4 (mapFiler.php) Remote Code Execution Vulnerability

No description provided by source. Advisory: Remote Command Execution in Mapbender During a penetration test RedTeam Pentesting discovered a remote command execution vulnerability in Mapbender. An unauthorized user can create arbitrary PHP-files on the Mapbender webserver, which can later be...

Mapbender 2.4.4 - mapFiler.php Remote Code Execution

Mapbender 2.4.4 - mapFiler.php Remote Code Execution Advisory: Remote Command Execution in Mapbender During a penetration test RedTeam Pentesting discovered a remote command execution vulnerability in Mapbender. An unauthorized user can create arbitrary PHP-files on the Mapbender webserver, which...

Mapbender <= 2.4.4 (mapFiler.php) Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Mapbender = 2.4.4 mapFiler.php Remote Code Execution Vulnerability ===================================================================== Advisory: Remote Command Executi...

Mapbender 2.4.4 - gaz SQL Injection

Mapbender 2.4.4 - gaz SQL Injection Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the...

Mapbender 2.4.4 - 'mapFiler.php' Remote Code Execution

Advisory: Remote Command Execution in Mapbender During a penetration test RedTeam Pentesting discovered a remote command execution vulnerability in Mapbender. An unauthorized user can create arbitrary PHP-files on the Mapbender webserver, which can later be executed. Details ======= Product:...

Mapbender 2.4.4 - 'gaz' SQL Injection

Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the Mapbender users. Details =======...

rt-sa-2007-004.txt

Advisory: ActiveWeb Contentserver CMS SQL Injection Management Interface RedTeam Pentesting discovered an SQL Injection in the picturerealedit.asp script of the activeWeb contentserver CMS during a penetration test. An editor with the permission to edit pictures can exploit this by injecting...

[Full-disclosure] ActiveWeb Contentserver CMS Editor Permission Settings Problem

Advisory: ActiveWeb Contentserver CMS Editor Permission Settings Problem RedTeam Pentesting discovered a problem with the permission settings in the management interface of the activeWeb contentserver CMS during a penetration test. The ability of an editor to create and edit documents can be...

[Full-disclosure] ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content

Advisory: ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content RedTeam Pentesting discovered a design vulnerability in the page editor of the activeWeb contentserver CMS during a penetration test. Filtering of user content, e.g. to prevent the usage of Javascript code, is done ...

rt-sa-2007-005.txt

Advisory: ActiveWeb Contentserver CMS Multiple Cross Site Scriptings RedTeam Pentesting discovered three Cross Site Scripting vulnerabilities in the activeWeb contentserver CMS during a penetration test. One of the Cross Site Scriptings is persistent. Details ======= Product: activeWeb...