doorGets CMS 5.2 - SQL Injection

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

AuraCMS 2.3 SQL Injection

Advisory ID: HTB23196 Product: AuraCMS Vendor: AuraCMS Vulnerable Versions: 2.3 and probably prior Tested Version: 2.3 Advisory Publication: January 8, 2014 without technical details Vendor Notification: January 8, 2014 Vendor Patch: January 30, 2014 Public Disclosure: February 5, 2014...

doorGets CMS 5.2 SQL Injection

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

Vtiger CRM 5.1.0 - 5.4.0 Authentication Bypass Vulnerability - Active Check

Vtiger CRM is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

Exclusive: More than 200,000 Algerian TP-LINK Routers are vulnerable to Hackers

More than 15.2% of the Algerian population use Internet service which is provided by around 30 Internet Service Providers and one of the largest shares is served by Algerie Telecom. Algerie Telecom provides TP-LINK TD-W8951ND Router to most of their home customers who Opt-In for Internet services...

Path Traversal in eduTrac

Advisory ID: HTB23190 Product: eduTrac Vendor: 7 Media Web Solutions, LLC. Vulnerable Versions: 1.1.1-Stable and probably prior Tested Version: 1.1.1-Stable Advisory Publication: December 11, 2013 without technical details Vendor Notification: December 11, 2013 Vendor Patch: December 16, 2013...

IrfanView远程缓冲区溢出漏洞

BUGTRAQ ID: 64561 CVECAN ID: CVE-2013-6932 IrfanView是一款快速、免费的图像查看器、浏览器、转换器。FORMATS插件可允许IrfanView读取不常见图形格式。 IrfanView 4.36及其他版本在实现上存在缓冲区溢出漏洞，使用了多字节的目录名称后，远程攻击者通过缩略图窗口内的缩略图提示信息功能所处理过的特制文件，利用此漏洞可执行任意代码。 0 IrfanView IrfanView 4.37 厂商补丁： IrfanView --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

nss security update

3.15.3-3.0.1.el65 - Added nss-vendor.patch to change vendor 3.15.3-3 - Revoke trust in one mis-issued anssi certificate - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate MFSA 2013-117 rhel-6.6...

nss, nspr, and nss-util security update

nspr 4.10.0-2 - Rebase to nspr-4.10.2 - Resolves: rhbz1032485 - CVE-2013-5607 MFSA 2013-103 Avoid unsigned integer wrapping in PLArenaAllocate MFSA 2013-103 nss 3.15.3-2.0.1 - Added nss-vendor.patch to change vendor 3.15.3-2 - Enable patch with fix for deadlock in trust domain lock and object loc...

Opencart Multiple Vulnerabilities

Title: Opencart Multiple Vulnerabilities Vendor: http://www.opencart.com Vulnerabilities: Arbitrary File Upload, XSS, Path Disclosure Vulnerable Version: opencart 1.5.6 prior versions also may be affected Exploitation: Remote with browser Impact: High Vendor Supplied Patch: N/A Original Advisory...

Remote Code Execution in Microweber

Advisory ID: HTB23175 Product: Microweber Vendor: Microweber Vulnerable Versions: 0.8 and probably prior Tested Version: 0.8 Advisory Publication: September 25, 2013 without technical details Vendor Notification: September 25, 2013 Vendor Patch: September 26, 2013 Public Disclosure: October 16,...

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. DesktopCentral Arbitrary File Upload Vulnerability Affected versions: DesktopCentral...

Microweber 0.8 Arbitrary File Deletion

Advisory ID: HTB23175 Product: Microweber Vendor: Microweber Vulnerable Versions: 0.8 and probably prior Tested Version: 0.8 Advisory Publication: September 25, 2013 without technical details Vendor Notification: September 25, 2013 Vendor Patch: September 26, 2013 Public Disclosure: October 16,...

[iBliss Security Advisory] Cross-Site Scripting (XSS) vulnerability in Design-approval-system wordpress plugin

Design-Approval-System Wordpress plugin XSS vendor product description A system to streamline the process of getting designs, photos, documents, videos or music approved by clients quickly. Bug Description The walkthrouth web page does not validate the step parameter leading to a Cross-site...

Multiple Vulnerabilities in X2CRM

Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September 25, 2013 Vulnerability Type: PH...

X2CRM 3.4.1 - Multiple Vulnerabilities

X2CRM 3.4.1 - Multiple Vulnerabilities Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure:...

vTiger CRM 5.4.0 - index.php?onlyforuser SQL Injection

vTiger CRM 5.4.0 - index.php?onlyforuser SQL Injection Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013...

vtiger CRM 5.4.0 SQL Injection Vulnerability

vtiger CRM version 5.4.0 suffers from a remote SQL injection vulnerability. Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerabili...

Microsoft Internet Explorer内存破坏漏洞(CVE-2013-3846)

BUGTRAQ ID: 62372 CVECAN ID: CVE-2013-3846 Internet Explorer，简称MSIE，是微软公司推出的一款网页浏览器。 Internet Explorer 9、10在处理CSpliceTreeEngine::InsertSplice创建的对象时存在安全漏洞，进程可被迫重新使用对象的悬挂指针，造成释放后重用，攻击者可利用此漏洞在用户浏览器上下文中执行任意代码 0 Microsoft Internet Explorer 6 - 10 厂商补丁： Microsoft ---------...

vtiger CRM 5.4.0 SQL Injection

Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...