CVE-2013-1622

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is not a security issue. Further investigation showed that, because of RFC noncompliance, no version or configuration of the product had the vulnerability previously associated with this ID. Notes: none...

SOL14154 - SQL injection vulnerability from an authenticated source CVE-2012-3000

Vulnerability Recommended Actions To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column. Acknowledgements F5 would like to acknowledge SEC Consult Vulnerability Lab for bringing this issue to our attention, and for following the...

TomatoCart 1.x | Cross Site Request Forgery Protection Bypass via JavaScript Hijacking

OVERVIEW TomatoCart 1.x versions are vulnerable to Cross Site Request Forgery Protection Bypass. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It is forked from osCommerce 3 as a separate project and is released under...

Samsung Kies 2.5.0.12114_1 Buffer Overflow Vulnerability

Samsung Kies version 2.5.0.121141 suffers from a buffer overflow vulnerability. Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.5.0.121141 Tested Version: 2.5.0.121141 on Windows 7 SP1 and Internet Explorer 9.0 Vendor Notification: December 19, 2012 Vendor Patch: December...

Havalite CMS - 'comment' HTML Injection

source: https://www.securityfocus.com/bid/57169/info Havalite CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to...

LShell 0.9.15 - Remote Code Execution

LShell 0.9.15 - Remote Code Execution import paramiko import traceback from time import sleep Exploit lshell pathing vulnerability in = 0.9.15. Runs commands on the remote system. @dronesec if lensys.argv 4: print '%s: USER PW IP opt: port'%sys.argv0 sys.exit1 try: print '!...

Sourcefabric Newscoop - 'f_email' SQL Injection

source: https://www.securityfocus.com/bid/56800/info Newscoop is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

Cryptocat 2.0.22 - Arbitrary Script Injection

source: https://www.securityfocus.com/bid/61093/info Cryptocat is prone to an arbitrary script-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code within the context of the application. Versions pri...

BloofoxCMS 0.3.5 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/56353/info bloofoxCMS is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context ...

Contao 2.11.6 Path Disclosure

title: Contao 2.11.6 Multiple vulnerabilities vulnerable version: 2.11.6 impact: medium homepage: www.contao.org found: 23.10.2012 by: aulmn Vendor description: Contao is an open source content management system CMS for people who want a professional internet presence that is easy to maintain...

VaM Shop 1.69 Cross Site Scripting / SQL Injection

Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1,69 and probably prior versions. Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: Security Effect Teamhttp://seceffect.tumblr.com/ Vulnerability Details: 1. Blind SQL injection in...

Amateur Photographers Image Gallery - plist.php?albumid Cross-Site Scripting

Amateur Photographers Image Gallery - plist.php?albumid Cross-Site Scripting source: https://www.securityfocus.com/bid/56110/info Amateur Photographer's Image Gallery is prone to multiple SQL injection vulnerabilities, a cross-site scripting vulnerability, and an arbitrary file-disclosure...

VLC Player 2.0.3 <= ReadAV Arbitrary Code Execution (Update)

!/usr/bin/perl VLC Player 2.0.3 = ReadAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://www.videolan.org/vlc/ Vendor Description: VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVD...

ISC BIND Cache Update Policy Deleted Domain Name Resolving Weakness

According to its self-reported version number, the remote installation of BIND will continue to allow revoked domain names to be resolved due to an issue related to the cache update policy. Note that Nessus has only relied on the version itself and has not attempted to determine whether or not th...

VICIDIAL Call Center Suite - Multiple SQL Injections

source: https://www.securityfocus.com/bid/55476/info VICIDIAL Call Center Suite is prone to multiple SQL-injection vulnerabilities and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to...

Tiki Wiki CMS Groupware jhot.php RCE Vulnerability

Tiki Wiki CMS Groupware is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Shockwave Player Multiple Vulnerabilities (Aug 2012) - Mac OS X

Adobe Shockwave Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Trombinoscope <= 3.5 SQLi Vulnerability - Active Check

Trombinoscope is prone to an SQL injection SQLi vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Plixer Scrutinize...

Dir2web - systemsrcdispatcher.php?oid SQL Injection

Dir2web - systemsrcdispatcher.php?oid SQL Injection source: https://www.securityfocus.com/bid/54845/info Dir2web is prone to multiple security vulnerabilities, including an SQL-Injection vulnerability and an information-disclosure vulnerability. Successfully exploiting these issues allows remote...