CVE-2008-2756: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/users.asp in Xigla Absolute Control Panel XE 1.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter and other unspecified parameters. NOTE: some of these details are obtained from third party information...

CVE-2008-2760: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2767: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2764: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors "all fields"...

CVE-2008-2757: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute News Manager XE 3.2 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2762: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2761: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in 1 searchbanners.asp and 2 listadvertisers.asp, and other unspecified fields. NOTE: some of these...

CVE-2008-2765: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in gallery.asp in Xigla Absolute Image Gallery XE allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewimage action...

CVE-2008-2766: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Xigla Absolute Image Gallery XE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 admin/search.asp and 2 gallery.asp...

CVE-2008-2758: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 pblname and 2 text parameters to a admin/search.asp, 3 name parameter to b admin/publishers.asp, and other unspecified...

CVE-2008-2759: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 showfields, 2 text, and 3 submissions parameters to search.asp and the 4 name parameter to users.asp. NOTE: some of these details are...

CVE-2008-2763: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2768: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to inject arbitrary web script or HTML via unspecified vectors "all fields"...

absolute-screwups.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Xigla Multiple Products - Multiple Vulnerabilities Vendor: http://www.xigla.com/ Exploit: N/A Impact: Medium Fix: N/A Original Advisory: http://bugreport.ir/index.php?/41 1. Description: Xigla company has several web based products From...

CVE-2007-4630

Cross-site scripting XSS vulnerability in xlaapmview.asp in Absolute Poll Manager XE 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2007-4630

Cross-site scripting XSS vulnerability in xlaapmview.asp in Absolute Poll Manager XE 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2007-4630

The CVE-2007-4630 issue is an XSS vulnerability in the xlaapmview.asp component of Absolute Poll Manager XE 4.1, allowing remote attackers to inject arbitrary script/HTML via the msg parameter. Affected: Absolute Poll Manager XE 4.1 (xlaapmview.asp). Root cause: improper handling/sanitization of ...

CVE-2007-4630: Undefined Security Weakness

Cross-site scripting XSS vulnerability in xlaapmview.asp in Absolute Poll Manager XE 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

PR07-23: Non-persistent Cross-site Scripting (XSS) on Absolute Poll Manager XE admin page

Date Found: 10th April 2007 Vendor informed: 4th July 2007 Successfully tested on: Absolute Poll Manager XE - Version 4.1. Earlier versions are possibly affected as well but have NOT been tested. Description: Absolute Poll Manager XE is vulnerable to a vanilla XSS within the...

Absolute Poll Manager XE 4.1 - xlaapmview.asp Cross-Site Scripting

Absolute Poll Manager XE 4.1 - xlaapmview.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/25492/info Absolute Poll Manager XE is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an...