[eVuln] Time Tracking Software Multiple Vulnerabilities

New eVuln Advisory: Time Tracking Software Multiple Vulnerabilities http://evuln.com/vulns/69/summary.html --------------------Summary---------------- eVuln ID: EV0069 CVE: CVE-2006-0689 CVE-2006-0690 CVE-2006-0691 Vendor: TTS Software Software: Time Tracking Software Sowtware's Web Site:...

TTS Software Time Tracking Software 3.0 - edituser.php Access Validation

TTS Software Time Tracking Software 3.0 - edituser.php Access Validation source: https://www.securityfocus.com/bid/16731/info Time Tracking Software is prone to an access-validation vulnerability. This issue is due the application's failure to limit access to administrative sections of the...

TTS Software Time Tracking Software 3.0 - 'edituser.php' Access Validation

source: https://www.securityfocus.com/bid/16731/info Time Tracking Software is prone to an access-validation vulnerability. This issue is due the application's failure to limit access to administrative sections of the application. An attacker can exploit this vulnerability to modify user data in...

Flyspray install-0.9.7.php adodbpath Parameter Remote File Inclusion

The remote host is running Flyspray, an open source, web-based, bug tracking system written in PHP. The installed version of Flyspray contains an installation script that does not require authentication and that fails to sanitize user input to the 'adodbpath' parameter before using it in a PHP...

Cross site scripting

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

Sql injection

Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-0691

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...

CVE-2006-0689

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

CVE-2006-0690

Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

Default credentials

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...

CVE-2006-0690

Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-0691

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...

CVE-2006-0690

CVE-2006-0690 affects TTS Time Tracking Software 3.0 with multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Public sources (NVD/eVuln) cite remote exploitation and, per eVuln, unauthorized data modification and additional...

CVE-2006-0689

CVE-2006-0689 affects TTS Software’s Time Tracking Software (Version 3.0). The vulnerability is a Cross-site Scripting (XSS) flaw in the Registration Form: the UserName parameter is not properly sanitized, allowing remote attackers to inject arbitrary script/HTML. Public disclosures in NVD and re...

CVE-2006-0691

CVE-2006-0691 concerns TTS Time Tracking Software 3.0. The vulnerability lies in edituser.php, which does not verify that the provided name and password are correct, enabling remote attackers to overwrite arbitrary data belonging to any account. Affected component: edituser.php in Time Tracking S...

CVE-2006-0689

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

The Bat! mail agent headers spoofing

message/partial format alows to spoof message headers completely, making it impossible to track sender by Received or Message-ID headers...

tor hidden services information disclosure

It's possible to discover location of hidden service by setting up malicious tor server, accessing hidden service repeatedly and tracking who builds circuits...

DSA-944-1 mantis - several

Bulletin has no description...

interspireXSS.txt

I.Vulnerability Interspire TrackPoint NX Cross Site Scripting Vulnerability II.Vendor Interspire www.interspire.com III.Affected Systems - Interspire TrackPoint NX 0.1 IV.About TrackPoint is a web based sales tracking software. V.Description An attacker is able to inject HTML and client-side scri...