EUVD-2014-2254

Malware in sbrugna...

Default credentials

The remember me feature in portal/scrauthentif.php in POSH aka Posh portal or Portaneo 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie...

CVE-2014-2212

The remember me feature in portal/scrauthentif.php in POSH aka Posh portal or Portaneo 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie...

CVE-2014-2212

POSH (POSH portal / Portaneo) is affected by multiple CVEs in 2014. CVE-2014-2211 describes an SQL injection in portal/addtoapplication.php via the rssurl parameter, enabling remote arbitrary SQL execution for POSH versions 3.0 before 3.3.0. CVE-2014-2212 reports a separate issue where the rememb...

CVE-2014-2211

SQL injection vulnerability in portal/addtoapplication.php in POSH aka Posh portal or Portaneo 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter...

Sql injection

SQL injection vulnerability in portal/addtoapplication.php in POSH aka Posh portal or Portaneo 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter...

CVE-2014-2211

SQL injection vulnerability in portal/addtoapplication.php in POSH aka Posh portal or Portaneo 3.0 before 3.3.0 allows remote attackers to execute arbitrary SQL commands via the rssurl parameter...

CVE-2014-2211

POSH (Posh portal / Portaneo) up to version 3.2.x is affected by an SQL injection in portal/addtoapplication.php via the rssurl parameter. The flaw allows remote attackers to inject and execute arbitrary SQL commands. Root cause is input handling for rssurl not being properly sanitized. Impact is...