CVE-2011-2150

The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error and daemon pause via vectors involving 1 certain cookies in a SiteInfoLookup action to...

CVE-2011-2152

The CVE-2011-2152 entry concerns SmarterTools SmarterStats 6.0 web server behavior: responses to GET requests with certain query strings (Client/frmViewReports.aspx or UserControls/Popups/frmHelp.aspx) generate pages containing external links, enabling cross-domain Referer leakage. This can allow...

CVE-2011-2149

CVE-2011-2149 affects SmarterTools SmarterStats 6.0 web server; multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQL via input parameters to Admin/frmSite.aspx, Default.aspx, Services/SiteAdmin.asmx, or Client/frmViewReports.aspx; cookies to Services/SiteAdmin.as...

CVE-2011-2151

CVE-2011-2151 concerns SmarterTools SmarterStats 6.0 where several admin and login pages (Admin/frmEmailReportSettings.aspx, Admin/frmGeneralSettings.aspx, Admin/frmSite.aspx, Client/frmUser.aspx, Login.aspx) accept cleartext passwords. The root cause is transmission of credentials in cleartext o...

CVE-2011-2158

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving 1 Admin/frmSite.aspx, 2 Admin/frmSites.aspx, 3 Admin/frmViewReports.aspx, 4...

CVE-2011-2151

The 1 Admin/frmEmailReportSettings.aspx, 2 Admin/frmGeneralSettings.aspx, 3 Admin/frmSite.aspx, 4 Client/frmUser.aspx, and 5 Login.aspx components in the SmarterTools SmarterStats 6.0 web server accept cleartext passwords, which makes it easier for remote attackers to obtain sensitive information...

CVE-2011-2152

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

CVE-2011-2150

CVE-2011-2150 concerns the SmarterTools SmarterStats 6.0 web server, where the XML storage path accepts unvalidated string data. The root cause is improper validation of strings intended for XML, enabling a remote denial-of-service condition through XML parsing errors. Attack vectors include cert...

CVE-2011-2156

The CVE covers SmarterTools SmarterStats 6.0 web server where remote attackers can obtain directory listings by requesting specific Admin/ and App_Themes/ directories (e.g., Admin/, Admin/Defaults/, App_Themes/, aspnet_client/, etc.). Root cause patients appear to be directory disclosure through ...

CVE-2011-2148

CVE-2011-2148 affects SmarterTools SmarterStats 6.0: Admin/frmSite.aspx allows remote command execution via OS command injection. The attacker can exploit a leading/trailing & and specific parameters (STTTState cookie; txtAdminNewPassword_SettingText; txtSmarterLogDirectory; ucSiteSeoSearchEngine...

SmarterTools default basic web server vulnerabilities

Overview Multiple SmarterTools applications install a default basic web server which contains multiple vulnerabilities Description Multiple SmarterTools applications by default install a basic web server which allows administrators to start using the application immediately after installation. Th...

SmarterTools SmarterMail 8.0 Cross Site Scripting

Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: March 14, 2011 Vendor: SmarterTools Application: SmarterMail Version 8.0 Bugs: Stored XSS, Reflected XSS Patch: None Available Timeline: Notify Vendor simultaneous with Vendor Publication:...

SmarterStats 6.0 Multiple Vulnerabilities

Exploit for asp platform in category web applications Vendor: SmarterTools Application: SmarterStats 6.0 Bugs: Directory Traversal, File Upload, OS Execution, XML Injection, SQL Injection, DoS Patch: The Vendor has released SmarterStats Version 6.2 at URI...

SmarterMail 7.3 and 7.4 Multiple Vulnerabilities

Exploit for php platform in category web applications Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP Injection, DoS Patch: The Vendor has released SmarterMail Version 8 at URI...

SmarterMail 7.37.4 - Multiple Vulnerabilities

SmarterMail 7.37.4 - Multiple Vulnerabilities Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: October 28, 2010 Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection,...

SmarterTools SmarterTrack Cross-Site Scripting Vulnerabilities

This host is running SmarterTools SmarterTrack and is prone Cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbsmartertrackmultxssvuln.nasl 5347 2017-02-19 09:15:55Z cfi $ SmarterTools SmarterTrack Cross-Site Scripting Vulnerabilities Authors: Madhuri D Copyright: Copyright c...

SmarterTools SmarterTrack XSS Vulnerabilities

SmarterTools SmarterTrack is prone to cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SmarterTools SmarterStats 5.3.3819 - frmHelp.aspx Cross-Site Scripting

SmarterTools SmarterStats 5.3.3819 - frmHelp.aspx Cross-Site Scripting source: https://www.securityfocus.com/bid/43110/info SmarterTools SmarterStats is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

SmarterTools SmarterStats 5.3.3819 - 'frmHelp.aspx' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43110/info SmarterTools SmarterStats is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

CVE-2009-4994

Cross-site scripting XSS vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter...