Multiple XSS Vulnerabilities in Jahia xCM

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Jahia xCM, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Multiple Cross-Site Scripting XSS Vulnerabilites in Jahia xCM: CVE-2013-4624 1.1 The...

Matterdaddy Market - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/60150/info Matterdaddy Market is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary script code, upload arbitrary files, steal...

Spider Event Calendar 1.3.0 Cross Site Scripting / Path Disclosure / SQL Injection

waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-104.html Descriptio...

[waraxe-2013-SA#098] - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1

waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-98.html Description of vulnerabl...

WordPress Plugin Spider Video Player - 'theme' SQL Injection

source: https://www.securityfocus.com/bid/59021/info Spider Video Player plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

WordPress Plugin Spiffy XSPF Player - 'playlist_id' SQL Injection

source: https://www.securityfocus.com/bid/58976/info Spiffy XSPF Player plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

Zimbra - aspell.php Cross-Site Scripting

Zimbra - aspell.php Cross-Site Scripting source: https://www.securityfocus.com/bid/58913/info Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser o...

Zimbra - 'aspell.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58913/info Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

MySQL 'yaSSL' Buffer Overflow Vulnerability

MySQL is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mysql:mysql"; ifdescription...

jPlayer - Jplayer.swf Script Cross-Site Scripting

jPlayer - Jplayer.swf Script Cross-Site Scripting source: https://www.securityfocus.com/bid/59030/info jPlayer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...

jPlayer - 'Jplayer.swf' Script Cross-Site Scripting

source: https://www.securityfocus.com/bid/59030/info jPlayer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Multiple Vulnerabilities in KrisonAV CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-Site Scripting XSS vulnerability in KrisonAV CMS: CVE-2013-2712 The vulnerability exists due to...

OpenCart 1.5.5.1 - FileManager.php Directory Traversal Arbitrary File Access

OpenCart 1.5.5.1 - FileManager.php Directory Traversal Arbitrary File Access waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location:...

OpenCart 1.5.5.1 - 'FileManager.php' Directory Traversal Arbitrary File Access

waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-98.html Description of vulnerabl...

OpenCart 1.5.5.1 Directory Traversal Vulnerability

OpenCart version 1.5.5.1 suffers from a directory traversal vulnerability. Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 ===================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web:...

CometChat RCE and XSS Vulnerabilities

CometChat is prone to a cross-site scripting XSS vulnerability and a remote code execution RCE vulnerability because the application fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

BlackNova Traders - news.php SQL Injection

BlackNova Traders - news.php SQL Injection source: https://www.securityfocus.com/bid/57910/info BlackNova Traders is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker ...

BlackNova Traders - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/57910/info BlackNova Traders is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...

MantisBT CVE-2013-1934 HTML Injection Vulnerability

Description MantisBT is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied data. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Scripts Genie Classified Ultra - SQL Injection Cross-Site Scripting

Scripts Genie Classified Ultra - SQL Injection Cross-Site Scripting source: https://www.securityfocus.com/bid/57465/info Classified Ultra is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting...