Symphony CMS XSS Vulnerability

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ Vendor: ================================ http://www.silverstripe.org/software/download Product: ================================ SilverStripe CMS & Framework v3.1.13 Advisory...

Symphony CMS 2.6.2 Cross Site Scripting

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt Vendor: ================================ www.getsymphony.com/download/ Product: ================================ Symphony CMS 2.6.2 Advisory Information:...

Security issue when parsing the Authorization header

More info at https://symfony.com/cve-2014-6061...

Symphony <= 1.7.01 (non-patched) Remote Code Execution Exploit

No description provided by source. ?php Symphony = 1.7.01 non-patched Remote Command Execution Exploit by Raz0r http://Raz0r.name Software site: http://21degrees.com.au/ works regardless magicquotesgpc echo -----------------------------------------------------------------\n; echo Symphony = 1.7.0...

symphony 2.0.7 - Multiple Vulnerabilities

No description provided by source. Symphony 2.0.7 Multiple Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS contact: sys-projectathotmail.com website: http://www.hack0wn.com/ - download: http://downloads.symphony-cms.com/symphony-package/36030/symphony-2.0.7.zip - CMS:...

symphony cms 2.3 - Multiple Vulnerabilities

No description provided by source. Symphony cms 2.3 multiple vulnerabilities -------------------------------------------------------------------------------------------- 20121017 - Justanotherhacker.com : Symphony cms - Multiple vulnerabilities JAHx122 -...

Symphony CMS 2.1.2 - Blind SQL Injection

No description provided by source. -------------------------------------------------------------------------------------------- 20110424 - Justanotherhacker.com : Symphony-cms blind sql injection JAHx111 - http://www.justanotherhacker.com/advisories/JAHx111.txt...

IBM Platform Symphony DE Auth-Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Platform Symphony DE. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2013-2559

SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

Sql injection

SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559...

CVE-2013-7346

Symphony CMS vulnerable before 2.3.2 to a Cross-Site Request Forgery (CSRF) that can hijack administrator authentication to perform SQL injection via the sort parameter in system/authors/. The issue is described as allowing remote (potentially unauthenticated via CSRF) execution of arbitrary SQL ...

CVE-2013-2559

Symphony CMS (before 2.3.2) is affected by a SQL injection in the sort parameter to system/authors/ that can be triggered by remote authenticated users; note that CSRF can enable remote unauthenticated attackers to execute arbitrary SQL commands. The issue is linked to CVE-2013-2559 and is also d...

CVE-2013-7346

Cross-site request forgery CSRF vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559...

CVE-2013-2559

SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

Symphony 2.2.4 - Cross-Site Request Forgery

Symphony 2.2.4 - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/66536/info Symphony is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the...

Symphony 2.2.4 - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/66536/info Symphony is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other...

IBM Platform Symphony Developer Edition Authentication Bypass Vulnerability

IBM Platform Symphony Developer Edition is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2013-5400

An unspecified servlet in IBM Platform Symphony Developer Edition DE 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors...

Hardcoded credentials

An unspecified servlet in IBM Platform Symphony Developer Edition DE 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors...