Open Web Analytics 1.5.7 XSS / Password Disclosure / Crypto Weakness

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-OPENWEBANALYTICS0721.txt Vendor: ================================ www.openwebanalytics.com Product: ================================ Open-Web-Analytics-1.5.7 Advisory...

SA-CONTRIB-2014-120 - Piwik Web Analytics - Information disclosure

This module enables you to integrate Drupal with Piwik Web Analytics. The module leaks the site specific hash salt to authenticated users when user-id tracking is turned on. This vulnerability is mitigated by the fact that user-id tracking must be turned on and the attacker needs to have an accou...

Open Web Analytics 1.5.6 PHP Object Injection Vulnerability

Exploit for php platform in category web applications Open Web Analytics setSetting'base', 'isremoteeventqueue', true; $owa-e-debug$POST; $rawevent = owacoreAPI::getRequestParam'event'; if $rawevent $dispatch = owacoreAPI::getEventDispatch; $event = unserialize base64decode $rawevent ;...

Open Web Analytics 1.5.7 Cross Site Scripting / Remote File Inclusion

Exploit Title : Open Web Analytics - v: 1.5.7 multiple vulnerability Author : Govind Singh aka NullPort Vendor : http://www.openwebanalytics.com/ Download Link : http://downloads.openwebanalytics.com/ Google Dork : "powered by Open Web Analytics" Date : 14/07/2014 Discovered at : IHT Lab 1ND14N...

Open Web Analytics 1.5.4 - (owa_email_address param) - SQL Injection Vulnerability

No description provided by source...

Piwik Open Flash Chart Remote Code Execution Vulnerability

No description provided by source. Bugtraq ID: 37314 Class: Input Validation Error CVE: Remote: Yes Local: No Published: Dec 14 2009 12:00AM Updated: Dec 17 2009 06:03PM Credit: Braeden Thomas Vulnerable: Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.4 Piwik Piwik 0.2.37 Piw...

Open Web Analytics 1.2.3 multi file include

No description provided by source. =========================================================================== Topic : Open Web Analytics 1.2.3 Bug type : multi file include Download : http://downloads.openwebanalytics.com/owa/owa123.tar Advisory :...

Open Web Analytics owa_email_address SQL Injection

The version of Open Web Analytics hosted on the remote web server fails to sanitize input to the 'owaemailaddress' parameter of the 'index.php' script before using it in a database query. An unauthenticated remote attacker can leverage this issue to manipulate database queries, resulting in the...

Open Web Analytics < 1.5.6 Multiple Vulnerabilities

According to its banner, the version of Open Web Analytics installed on the remote host is prior to version 1.5.6. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting flaw exists with the login page where input to the 'owauserid' parameter is not properly...

Open Web Analytics Detection

Binary data openwebanalyticsdetect.nbin...

Open Web Analytics Password Reset Page owa_email_address Parameter SQL Injection

SQL injection vulnerability in the password reset page in Open Web Analytics OWA before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owaemailaddress parameter in a base.passwordResetRequest action to index.php. Vulnerability Type: SQL Injection For the exploit source co...

[SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection

Dell SecureWorks Security Advisory SWRX-2014-001 Open Web Analytics Pre-Auth SQL Injection Advisory Information Title: Open Web Analytics Pre-Auth SQL Injection Advisory ID: SWRX-2014-001 Advisory URL: http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-001/ Date published:...

Yahoo!: XSS in Yahoo! Web Analytics

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Open Web Analytics 'owa_event'参数PHP对象注入漏洞

Bugtraq ID:66076 CVE ID:CVE-2014-2294 Open Web Analytics是一款基于PHP+MySQL开发的、开源的网络分析软件,可以用来追踪和分析人们是怎样访问你的网站和应用程序的。 Open Web Analytics queue.php不正确过滤通过"owaevent" POST参数提交给"unserialize"的输入，允许远程攻击者利用漏洞通过特制的序列化对象操作部分受限配置选项或创建或覆盖任意文件。 0 Open Web Analytics 1.5.6 厂商补丁： Open Web Analytics ----- Open Web...

Open Web Analytics < 1.5.6 Reflected XSS Vulnerability - Active Check

Open Web Analytics is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-1456

Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...

CVE-2014-1456

Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...

CVE-2014-1456

Cross-site scripting XSS vulnerability in the login page in Open Web Analytics OWA before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owauserid parameter to index.php...

CVE-2014-1456

Open Web Analytics (OWA) prior to version 1.5.6 is affected by CVE-2014-1456, a cross-site scripting (XSS) vulnerability in the login page. The issue allows injection of arbitrary script or HTML via the owa_user_id parameter to index.php, with impact described as partial integrity impact and no c...