OrangeHRM 2.7.1-rc.1 Cross Site Request Forgery / SQL Injection

Advisory ID: HTB23119 Product: OrangeHRM Vendor: OrangeHRM Inc. Vulnerable Versions: 2.7.1-rc.1 and probably prior Tested Version: 2.7.1-rc.1 Vendor Notification: October 10, 2012 Public Disclosure: October 31, 2012 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2012-5367 CVSSv2 Base...

Multiple Vulnerabilities in LibreOffice

Advisory ID: HTB23106 Product: LibreOffice Suite Vendor: LibreOffice Vulnerable Versions: 3.5.5.3 and probably prior Tested Version: 3.5.5.3 Vendor Notification: July 26, 2012 Public Disclosure: October 31, 2012 Vulnerability Type: NULL Pointer Dereference CWE-476 CVE Reference: CVE-2012-4233...

Debian DSA-2570-1 : openoffice.org - several vulnerabilities

High-Tech Bridge SA Security Research Lab discovered multiple NULL pointer dereferences based vulnerabilities in OpenOffice.org which could cause application crash or even arbitrary code execution using specially crafted files. Affected file types are LWP Lotus Word Pro, ODG, PPT PowerPoint 2003...

[SECURITY] [DSA 2570-1] openoffice.org security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2570-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez October 31, 2012 http://www.debian.org/security/faq -...

Multiple vulnerabilities in dotProject

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in dotProject, which can be exploited to perform SQL injection and cross-site scripting XSS attacks. 1 SQL Injection in dotProject: CVE-2012-5701 High-Tech Bridge Security Research Lab has discovered multiple SQL injection...

Windows website loophole allow anyone to get WIndows 8 in just $14.99

Windows 8 launched in 37 languages and 140 worldwide markets, as the tech giant unveiled the new version of its computer operating system. The OS is now available in over 30 certified devices, and a broad selection of local apps are already available in the onboard Windows Store. It is also...

Multiple vulnerabilities in AContent

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

Multiple vulnerabilities in Subrion CMS

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Multiple vulnerabilities in OpenX

Advisory ID: HTB23116 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: September 19, 2012 Public Disclosure: October 10, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References: CVE-2012-4989,...

subrion CMS 2.2.1 - Multiple Vulnerabilities

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

ATutor 1.2 Multiple Vulnerabilities

SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79 CVE References: CVE-2012-5167, CVE-2012-5168, CVE-2012-5169 CVSSv2 Base Scores: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Product: AContent Vendor: ATutor...

DSA-2570-1 openoffice.org - remote

Bulletin has no description...

ATutor AContent 1.2 XSS / Authentication / SQL Injection

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

jCore 1.0pre Cross Site Scripting / SQL Injection

Advisory ID: HTB23107 Product: jCore Vendor: jcore.net Vulnerable Versions: 1.0pre and probably prior Tested Version: 1.0pre Vendor Notification: August 1, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79 CVE References: CVE-2012-4231,...

jCore 1.0pre Cross Site Scripting / SQL Injection

Exploit for php platform in category web applications Product: jCore Vendor: jcore.net Vulnerable Versions: 1.0pre and probably prior Tested Version: 1.0pre Vendor Notification: August 1, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-7...

Subrion CMS 2.2.1 XSS / CSRF / SQL Injection

-------------------- Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Samsung Kies 2.3.2.12054_20 - Multiple Vulnerabilities

Samsung Kies 2.3.2.1205420 - Multiple Vulnerabilities Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability...

Samsung Kies 2.3.2.12054_20 - Multiple Vulnerabilities

Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability Type: NULL Pointer Dereference CWE-476, Improper Access...

TVMOBiLi Media Server Multiple Remote DoS Vulnerabilities

High-Tech Bridge Security Research Lab has discovered 2 remote DoS vulnerabilities in TVMOBiLi Media server, which could be exploited to crash remote server with malicious HTTP requests. 1 Improper Handling of Length Parameter Inconsistency in TVMOBiLi: CVE-2012-5451 1.1 The vulnerability exists...

Samsung Kies 2.3.2.12054_20 NULL Pointer Dereference / Access Control

Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability Type: NULL Pointer Dereference CWE-476, Improper Access...