Ripe Website Manager 1.1 XSRF / XSS / SQL Injection

================================ Vulnerability ID: HTB22898 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinripewebsitemanager.html Product: Ripe website manager Vendor: Ripe website manager Team http://www.ripewebsitemanager.com/ Vulnerable Version: 1.1 and probably prior versions Vendor...

Ripe Website Manager 1.1 - Cross-Site Scripting / Multiple SQL Injections

source: https://www.securityfocus.com/bid/47017/info Ripe Website Manager is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary...

Ripe Website Manager 1.1 - Cross-Site Scripting Multiple SQL Injections

Ripe Website Manager 1.1 - Cross-Site Scripting Multiple SQL Injections source: https://www.securityfocus.com/bid/47017/info Ripe Website Manager is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied dat...

Lush Cosmetics Australian website hacked !

The Australian and New Zealand shopping site of cosmetics retailer Lush has been hacked just weeks after a similar breach occurred on the UK site. Credit card details and other intimate information of shoppers have been exposed. If you visit the Lush Cosmetics Australian website you will find a...

Cross site scripting

Cross-site scripting XSS vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving 1 month, 2 day, and 3 year fields...

CVE-2008-3849

Cross-site scripting XSS vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving 1 month, 2 day, and 3 year fields...

CVE-2008-3849

CVE-2008-3849 describes a Cross-site scripting (XSS) vulnerability in the calendar controller of Civic Website Manager prior to version 1.0.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fiel...

CVE-2008-3849

Cross-site scripting XSS vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving 1 month, 2 day, and 3 year fields...

Sql injection

Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c navigation/deleteitem.php ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c...

CVE-2007-4523

Multiple cross-site scripting XSS vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c...

CVE-2007-4522

Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c navigation/deleteitem.php ...

CVE-2007-4523

CVE-2007-4523 affects Ripe Website Manager 0.8.9 and earlier, describing multiple cross-site scripting (XSS) vulnerabilities. autenthenticated remote users can inject arbitrary script/HTML via several parameters across admin pages (e.g., id in pages/delete_page.php, navigation/delete_menu.php/del...

CVE-2007-4522

Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c navigation/deleteitem.php ...

CVE-2007-4522

CVE-2007-4522 affects Ripe Website Manager

CVE-2007-4523

Multiple cross-site scripting XSS vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c...

OS2A_1009.txt

Ripe Website Manager SQL Injection and Cross Site Scripting Vulnerabilities OS2A ID: OS2A1009 Status: 07/11/2007 Issue Discovered 07/12/2007 Reported to the Vendor 08/22/2007 Public Release Class: SQL Injection and Cross Site Scripting Severity: High Overview: --------- Ripe Website Manager is a...

Ripe Website Manager SQL Injection and Cross Site Scripting Vulnerabilities

Ripe Website Manager SQL Injection and Cross Site Scripting Vulnerabilities OS2A ID: OS2A1009 Status: 07/11/2007 Issue Discovered 07/12/2007 Reported to the Vendor 08/22/2007 Public Release Class: SQL Injection and Cross Site Scripting Severity: High Overview: --------- Ripe Website Manager is a...

Ripe Website Manager 0.8.x - pagesdelete_page.php?id SQL Injection

Ripe Website Manager 0.8.x - pagesdeletepage.php?id SQL Injection source: https://www.securityfocus.com/bid/25406/info Ripe Website Manager is prone to multiple input-validation vulnerabilities, including HTML- and SQL-injection issues. Exploiting these issues could allow an attacker to steal...

Ripe Website Manager 0.8.x - '/pages/delete_page.php?id' SQL Injection

source: https://www.securityfocus.com/bid/25406/info Ripe Website Manager is prone to multiple input-validation vulnerabilities, including HTML- and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application,...