SEC Consult SA-20150409-0 :: Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows

SEC Consult Vulnerability Lab Security Advisory 20150409-0 ======================================================================= title: Multiple XSS & XSRF vulnerabilities product: Comalatech Comala Workflows vulnerable version: = 4.6.1 fixed version: 4.6.2 for Confluence 5.4+ and 4.5.4 for...

Comala Workflows /plugins/approvalsworkflow/saveworkflowmarkup.action has multiple reflected cross-site scripting vulnerabilities

Comala Workflows is a WEB-based application. Comala Workflows /plugins/approvalsworkflow/saveworkflowmarkup.action script processing attachment-macro has a cross-site scripting vulnerability that can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it...

Multiple Cross-Site Scripting Vulnerabilities in Comala Workflows saveproperties.action

Comala Workflows is a WEB-based application. Multiple cross-site scripting vulnerabilities exist in the Comala Workflows saveproperties.action script, which can be exploited by a remote attacker to construct a malicious URI and trick a user into parsing it, which can be used to obtain a sensitive...

Comala Workflows /plugins/approvalsworkflow/saveworkflowmarkup.action Cross-Site Request Forgery Vulnerability

Comala Workflows is a WEB-based application. A cross-site request forgery vulnerability exists in Comala Workflows /plugins/approvalsworkflow/saveworkflowmarkup.action, which allows remote attackers to construct malicious URIs, trick users into parsing them, and execute malicious actions in the...

Comala Workflows newtask.action taskName has multiple reflected cross-site scripting vulnerabilities

Comala Workflows is a WEB-based application. Comala Workflows newtask.action script handles A cross-site scripting vulnerability exists in taskName, which can be exploited by a remote attacker to construct a malicious URI and trick the user into parsing it, which can be used to obtain a sensitive...

Comalatech Comala Workflows 4.6.1 CSRF / XSS Vulnerabilities

Comalatech Comala Workflows versions 4.6.1 and below suffer from cross site request forgery and cross site scripting vulnerabilities. title: Multiple XSS & XSRF vulnerabilities product: Comalatech Comala Workflows vulnerable version: = 4.6.1 fixed version: 4.6.2 for Confluence 5.4+ and 4.5.4 for...

Comalatech Comala Workflows 4.6.1 CSRF / XSS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple XSS & XSRF vulnerabilities product: Comalatech Comala Workflows vulnerable version: = 4.6.1 fixed version: 4.6.2 for Confluence 5.4+ and 4.5.4 for Confluence 4.3...

Wordpress Work-The-Flow Plugin 1.2.1 - Arbitrary File Upload

No description provided by source. !/usr/bin/env python -- coding: utf-8 -- from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register from pocsuite.lib.utils.password import getWeakPassword from pocsuite.lib.utils.password import getLargeWeakPasswor...

CVE-2013-0081

Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service W3WP process hang via a crafted URL, aka "SharePoint Denial of Service Vulnerability."...

CVE-2012-3799

Multiple cross-site request forgery CSRF vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 change workflows or 2 insert cross-site scripting XSS sequences...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 change workflows or 2 insert cross-site scripting XSS sequences...

SA-CONTRIB-2012-009 - Revisioning - Access bypass

CVE: CVE-2012-1635 This module enables you to create moderation publication workflows, allowing authors to create content that isn't visible to the public until it has been approved by a moderator/publisher. The module's implementation of hooknodeaccess assumes that access is to granted/denied...

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

CVE-2009-1078

Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the expected privilege requirements for 1 deleting audit policies and 2 modifying workflows, which allows remote authenticated users to have an unspecified impact...

CVE-2009-1078: Undefined Security Weakness

Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the expected privilege requirements for 1 deleting audit policies and 2 modifying workflows, which allows remote authenticated users to have an unspecified impact...

CVE-2008-5686

IBM Tivoli Provisioning Manager TPM before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as...

CVE-2008-5686

IBM Tivoli Provisioning Manager TPM before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as...

CVE-2008-5686: Improper Authentication

IBM Tivoli Provisioning Manager TPM before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as...

CARE2X 1.1 - ROOT_PATH Remote File Inclusion

CARE2X 1.1 - ROOTPATH Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV72$2007 ------------------------------------------------------------------------- ECHOADV72$2007 CARE2X rootpath Remote File Inclusion Vulnerability...