X2CRM 3.4.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September...

X2CRM 3.4.1 - Multiple Vulnerabilities

Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September 25, 2013 Vulnerability Type: PH...

X2CRM 3.4.1 - Multiple Vulnerabilities

X2CRM 3.4.1 - Multiple Vulnerabilities Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure:...

X2CRM 3.4.1 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September 25, 2013 Vulnerability Type: PH...

Multiple Vulnerabilities in X2CRM

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform Cross-Site Sripting XSS attacks against users of vulnerable application. 1 PHP File Inclusion in X2CRM...

Joomla Unauthorized File Upload Remote Code Execution

A remote code execution vulnerability has been reported in Joomla. The vulnerability is due to improper validation of an uploaded file's extension. A remote attacker may exploit this issue by uploading a specially crafted php file. Successful exploitation would allow an attacker to execute...

SocialEngine 4.5 Shell Upload

INTRODUCTION ------------------------------------------------------------- The plugin has the objective give you a better visual for the user profile, allowed the addition of cover image keeping the layout closest to the style of modern social networks, among other features. + DESCRIPTION OF...

SocialEngine 4.5 Shell Upload Vulnerability

SocialEngine version 4.5 suffers from a remote shell upload vulnerability. + INTRODUCTION ------------------------------------------------------------- The plugin has the objective give you a better visual for the user profile, allowed the addition of cover image keeping the layout closest to the...

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload

Exploit Title: Sending php file in the timeline plugin cover image of SocialEngine 4.5 Date: 2013-08-17 Discovered by: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://webhive.com.ua/ Software Link: http://webhive.com.ua/store/product.php?idproduct=46 Version: plugin Timeline 4.2.5p9 fo...

Multiple Vulnerabilities in OpenX

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

Multiple Vulnerabilities in Exponent CMS

Advisory ID: HTB23154 Product: Exponent CMS Vendor: Online Innovative Creations Vulnerable Versions: 2.2.0 beta 3 and probably prior Tested Version: 2.2.0 beta 3 Vendor Notification: April 24, 2013 Vendor Patch: May 3, 2013 Public Disclosure: May 15, 2013 Vulnerability Type: SQL Injection CWE-89,...

OpenX 2.8.10 - Multiple Vulnerabilities

OpenX 2.8.10 - Multiple Vulnerabilities Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion...

OpenX 2.8.10 - Multiple Vulnerabilities

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

OpenX 2.8.10 Cross Site Scripting / Local File Inclusion Vulnerabilities

OpenX version 2.8.10 suffers from cross site scripting and local file inclusion vulnerabilities. Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP...

OpenX 2.8.10 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23155 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: May 8, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: PHP File Inclusion CWE-98, Cross-Site Scripting CWE-79 CVE...

HP Insight Diagnostics 8.20 b2878 multiple vulnerabilities

HP Insight Diagnostics 9.4.0.4710 allows remote attackers to conduct unspecified injection attacks via unknown vectors. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported: Environment: Tested on both windows and linux x32 platforms. The installation requires HP Insight...

HP System Management Homepage contains a command injection vulnerability

Overview HP System Management Homepage contains a command injection vulnerability CWE-77 that may result in arbitrary command execution and privilege escalation. Description Markus Wulftange from Daimler TSS reports: The vulnerability is located in the ginkgosnmp.inc PHP file in the...

gpEasy CMS 4.0 Shell Upload Vulnertability

gpEasy CMS version 4.0 suffers from a remote shell upload vulnerability. Exploit Title : gpEasy CMS Malicious File Upload Date : 4 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://gpeasy.com/ Software Link : http://gpeasy.com/SpecialgpEasy?cmd=dlzip Versio...

php LFI to read the php file source code as well as directly post webshell-vulnerability warning-the black bar safety net

Recently in the busy defcon topic training where a set of topics where there is a foreigner to write it is mentioned in the LFI, another tips The original text please refer to the PS: the skill is not a new technology bull God has certainly been with got bored, so when passing on the line =,= I...

Exponent CMS 2.2.0 Beta 3 - Multiple Vulnerabilities

Exponent CMS 2.2.0 Beta 3 - Multiple Vulnerabilities Advisory ID: HTB23154 Product: Exponent CMS Vendor: Online Innovative Creations Vulnerable Versions: 2.2.0 beta 3 and probably prior Tested Version: 2.2.0 beta 3 Vendor Notification: April 24, 2013 Vendor Patch: May 3, 2013 Public Disclosure: M...