EUVD-2009-3726

Malware in sbrugna...

EUVD-2009-3727

Malware in sbrugna...

EUVD-2009-3728

Malware in sbrugna...

phpbms 0.96 Multiple Vulnerabilities

No description provided by source. phpBMS v0.96 phpbms.org eLwauxc2009, uasc.org.ua http://phpbms.org/trial/ SQL Inj -------------------------------------------------------------------------------------------------------------------------------------------------------------------------...

Sql injection

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to modules/bms/invoicesdiscountajax.php, 2 f parameter to dbgraphic.php, and 3 tid parameter in a show action to advancedsearch.php...

Information disclosure

phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 the show action in advancedsearch.php, and 4 choicelist.php, which reveals the installation path in an error message...

CVE-2009-3754

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to modules/bms/invoicesdiscountajax.php, 2 f parameter to dbgraphic.php, and 3 tid parameter in a show action to advancedsearch.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php and 2 modules\base\myaccount.php; and the PATHINFO to 3 modulesview.php, 4 tabledefsoptions.php, and 5 adminsettings.php in...

CVE-2009-3756

phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 the show action in advancedsearch.php, and 4 choicelist.php, which reveals the installation path in an error message...

CVE-2009-3755

Multiple cross-site scripting XSS vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php and 2 modules\base\myaccount.php; and the PATHINFO to 3 modulesview.php, 4 tabledefsoptions.php, and 5 adminsettings.php in...

CVE-2009-3754

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to modules/bms/invoicesdiscountajax.php, 2 f parameter to dbgraphic.php, and 3 tid parameter in a show action to advancedsearch.php...

CVE-2009-3755

phpBMS 0.96 is affected by multiple cross-site scripting (XSS) vulnerabilities triggered by PATH_INFO input. The issues affect index.php and modules/base/myaccount.php, as well as modules_view.php, tabledefs_options.php, and adminsettings.php within phpbms\modules\base. The root cause is improper...

CVE-2009-3756

phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 the show action in advancedsearch.php, and 4 choicelist.php, which reveals the installation path in an error message...

CVE-2009-3755

Multiple cross-site scripting XSS vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php and 2 modules\base\myaccount.php; and the PATHINFO to 3 modulesview.php, 4 tabledefsoptions.php, and 5 adminsettings.php in...

CVE-2009-3756

The vulnerability CVE-2009-3756 affects phpBMS 0.96. An information-disclosure flaw allows remote attackers to obtain the installation path by directly requesting (1) footer.php, (2) header.php, (3) the show action in advancedsearch.php, or (4) choicelist.php. The error message reveals the instal...

CVE-2009-3754

CVE-2009-3754 affects phpBMS 0.96, with multiple SQL injection vulnerabilities. The flaws allow remote attackers to craft input to three endpoints—modules/bms/invoices_discount_ajax.php (id parameter), dbgraphic.php (f parameter), and advancedsearch.php (tid parameter in a show action)—to execute...

CVE-2009-3755: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php and 2 modules\base\myaccount.php; and the PATHINFO to 3 modulesview.php, 4 tabledefsoptions.php, and 5 adminsettings.php in...

CVE-2009-3754: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to modules/bms/invoicesdiscountajax.php, 2 f parameter to dbgraphic.php, and 3 tid parameter in a show action to advancedsearch.php...

CVE-2009-3756: Exposure of Sensitive Information to an Unauthorized Actor

phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 the show action in advancedsearch.php, and 4 choicelist.php, which reveals the installation path in an error message...

phpBMS 0.96 Multiple Remote Vulnerabilities

No description provided by source. phpBMS v0.96 phpbms.org eLwauxc2009, uasc.org.ua http://phpbms.org/trial/ SQL Inj -------------------------------------------------------------------------------------------------------------------------------------------------------------------------...