SEC Consult SA-20120315-0 :: Multiple permanent XSS vulnerabilities in EMC Documentum eRoom

SEC Consult Vulnerability Lab Security Advisory 20120315-0 ======================================================================= title: Multiple permanent cross-site scripting vulnerabilities product: EMC Documentum eRoom vulnerable version: 7.33.498.98 fixed version: 7.4.4 impact: high homepag...

Barracuda CudaTel v2.0.029.1 - Multiple Web Vulnerabilities

Title: ====== Barracuda CudaTel v2.0.029.1 - Multiple Web Vulnerabilities Date: ===== 2012-03-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=442 VL-ID: ===== 442 Introduction: ============= Designed to enable seamless voice and video communication, the CudaTel...

Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities

Title: ====== Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities Date: ===== 2012-03-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=470 VL-ID: ===== 470 Introduction: ============= SysAid IT Enterprise Edition is an IT management solution that includes a suite of...

ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-012: EMC Documentum eRoom multiple vulnerabilities EMC Identifier: ESA-2012-012 CVE Identifiers: CVE-2012-0398, CVE-2012-0404 Severity Rating: CVE-2012-0398 : CVSS Base Score is 5.8 AV:A/AC:L/Au:N/C:P/I:P/A:P CVE-2012-0404 : CVSS Base Score i...

FlexCMS 3.2.1 Cross Site Scripting

Persistent XSS in FLEXCMS 3.2.1 Software vendor: http://www.flexcms.com/flex/index.html The Persistent XSS appears when any user go to edit profile Display name and then injects the xss code instead of his display name. After inkection this code. In the main page of the webiste, there is "Users...

FlexCMS 3.2.1 - Persistent Cross-Site Scripting

Persistent XSS in FLEXCMS 3.2.1 Software vendor: http://www.flexcms.com/flex/index.html The Persistent XSS appears when any user go to edit profile Display name and then injects the xss code instead of his display name. After inkection this code. In the main page of the webiste, there is "Users...

FlexCMS 3.2.1 - Persistent Cross-Site Scripting

FlexCMS 3.2.1 - Persistent Cross-Site Scripting Persistent XSS in FLEXCMS 3.2.1 Software vendor: http://www.flexcms.com/flex/index.html The Persistent XSS appears when any user go to edit profile Display name and then injects the xss code instead of his display name. After inkection this code. In...

FlexCMS 3.2.1 for logged in users XSS

Exploit for php platform in category web applications Persistent XSS in FLEXCMS 3.2.1 Software vendor: http://www.flexcms.com/flex/index.html The Persistent XSS appears when any user go to edit profile Display name and then injects the xss code instead of his display name. After inkection this...

CVE-2012-0398

CVE-2012-0398 affects EMC Documentum eRoom prior to 7.4.4. The flaw involves improper validation of session cookies, enabling remote attackers to hijack or replay user sessions via unspecified vectors. EMC’s advisory/esg127683 recommends upgrading to eRoom 7.4.4 to remediate. Other connected sour...

CVE-2012-0398

EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors...

Barracuda CudaTel 2.0.029.1 Cross Site Scripting

Title: ====== Barracuda CudaTel v2.0.029.1 - Multiple Web Vulnerabilities Date: ===== 2012-03-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=442 VL-ID: ===== 442 Introduction: ============= Designed to enable seamless voice and video communication, the CudaTel...

Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability

Document Title: =============== Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=444 Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 444...

Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability

Document Title: =============== Barracuda WAF 660 v7.6.0.028 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=444 Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 444...

Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities

Document Title: =============== Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=470 Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 470...

Barracuda CudaTel v2.0.029.1 - Multiple Vulnerabilities

Document Title: =============== Barracuda CudaTel v2.0.029.1 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=442 Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 442...

LDAP Account Manager Pro 3.6 跨站脚本和HTML注入漏洞

LDAP Account Manager LAM是一个基于浏览器的LDAP帐号管理系统 LDAP Account Manager LAM存在多个持久型输入校验漏洞，允许攻击者在应用程序段实现恶意脚本代码，成功利用漏洞操作数据或劫持会话user/mod/admin 另外也受客户端跨站脚本漏洞，允许攻击者劫持目标用户/admin会话 0 LDAP Account Manager Pro 3.6 厂商解决方案 目前没有详细解决方案提供： http://lam.sourceforge.net/index.htm...

LDAP Account Manager Pro v3.6 - Multiple Vulnerabilities

Document Title: =============== LDAP Account Manager Pro v3.6 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=458 Release Date: ============= 2012-03-01 Vulnerability Laboratory ID VL-ID: ==================================== 45...

Missing 'Secure' Cookie Attribute (HTTP)

The remote HTTP web server / application is missing to set the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

LDAP Account Manager Pro v3.6 - Multiple Vulnerabilities

Document Title: =============== LDAP Account Manager Pro v3.6 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=458 Release Date: ============= 2012-03-01 Vulnerability Laboratory ID VL-ID: ==================================== 45...

Adobe Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Adobe Website - Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=371 Release Date: ============= 2012-02-27 Vulnerability Laboratory ID VL-ID: ==================================== 371...