559 matches found
Cross-site Scripting (XSS) Vulnerability in PHP Directory Listing Script
High-Tech Bridge SA Security Research Lab has discovered vulnerability in PHP Directory Listing Script which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in PHP Directory Listing Script The vulnerability exists due to input sanitation error ...
Cross-site Scripting Vulnerability in Microsoft SharePoint Server 2007
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Microsoft SharePoint Server 2007 which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting vulnerability in Microsoft SharePoint Server 2007: CVE-2010-0817 An input sanitation error was found ...
CSRF (Cross-Site Request Forgery) in DClassifieds
High-Tech Bridge SA Security Research Lab has discovered vulnerability in DClassifieds, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Cross-site request forgery CSRF in DClassifieds: CVE-2012-0990 The application allows authorized users to perform certain actions vi...
SQL Injection Vulnerabilities in WP Forum Server
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WP Forum Server WordPress plugin which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerabilities in WP Forum Server 1.1 The vulnerability exists due to input sanitation errors in the...
Multiple vulnerabilities in EspoCRM
High-Tech Bridge Security Research Lab discovered multiple high-risk vulnerabilities in EspoCRM, which can be exploited by remote attacker to execute arbitrary PHP code on a vulnerable system, reinstall the application from scratch, and compromise the entire system as the result. EspoCRM is also...
Cross-Site Scripting (XSS) in CMSimple
High-Tech Bridge Security Research Lab discovered vulnerability in CMSimple, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in CMSimple: CVE-2014-2219 The vulnerability exists due to insufficient sanitisation of user-supplied data in "d"...
Privilege Escalation Vulnerability in Microsoft Windows
High-Tech Bridge Security Research Lab has discovered a vulnerability in Microsoft Windows which could be exploited to escalate privileges under certain conditions. The vulnerability exists due to the “IKE and AuthIP IPsec Keying Modules” system service, which tries to load the “wlbsctrl.dll” DLL...
Multiple vulnerabilities in PHPShop CMS Free
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PHPShop CMS Free, which can be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-Site Scripting in PHPShop CMS Free 1.1 Input appended to the URL after multiple files is not properly...
Installation Path Disclosure Weakness in xt:Commerce
High-Tech Bridge SA Security Research Lab has discovered a weakness in xt:Commerce which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in xt:Commerce The weakness exists due to application reveals the full path to installation...
Multiple XSS in Chyrp
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Chyrp, which can be exploited to perform Cross Site Scripting attacks. 1 Cross Site Scripting XSS in Chyrp: CVE-2012-1001 1.1 Input passed via the "content" POST parameter to /includes/ajax.php is not properly...
Cross-site Scripting (XSS) Vulnerability in Tiki Wiki CMS Groupware
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Tiki Wiki CMS Groupware, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware Input passed via the GET "ajax" parameter to snarfajax.php is not...
Multiple Vulnerabilities in Collabtive
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Collabtive which could be exploited to perform cross-site scripting and cross-site request forgery attacks and gain access to sensitive information. 1 Cross-site scripting XSS vulnerability in Collabtive 1.1 The...
Multiple Vulnerabilities in Smartphone Pentest Framework (SPF)
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Smartphone Pentest Framework SPF web-based GUI, which could be exploited to get control over a pentester's machine. The research was inspired by the vulnerability found by Jon Passki http://osvdb.org/85873. Even if the...
Cross-Site Scripting (XSS) in Redaxo
High-Tech Bridge Security Research Lab has discovered vulnerability in Redaxo, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Redaxo: CVE-2012-3869 1.1 Input passed via the "subpage" GET parameter to /redaxo/index.php when "page" is set to "user"...
Cross-Site Scripting (XSS) in Komento Joomla Extension
High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Komento Joomla Extension, which can be exploited to perform script insertion attacks. 1 Cross-Site Scripting XSS in Komento Joomla Extension: CVE-2014-0793 1.1 The vulnerability exists due to insufficient sanitisation of...
Cross-Site Scripting (XSS) in GuppY
High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in GuppY, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in GuppY: CVE-2013-5983 1.1 The vulnerability exists due to insufficient...
Cross-Site Scripting (XSS) in Photo Gallery WordPress plugin
High-Tech Bridge Security Research Lab discovered three vulnerabilities in Photo Gallery WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Photo Gallery WordPress plugin: CVE-2014-6315 1.1 Input passed via the "callback" HTTP GET...
SQL Injection in doorGets CMS
High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...
Cross-Site Request Forgery (CSRF) in UMI.CMS
High-Tech Bridge Security Research Lab discovered CSRF vulnerability in UMI.CMS, which can be exploited to perform Cross-Site Request Forgery CSRF attacks and create new administrator in the vulnerable application. 1 Cross-site Request Forgery CSRF in UMI.CMS: CVE-2013-2754 The application allows...
Cross-site Scripting (XSS) Vulnerabilities in YaPiG
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in YaPiG which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in YaPiG 1.1 The vulnerability exists due to input sanitation errors in multiple scripts inside t...
Cross-Site Scripting (XSS) in Feng Office
High-Tech Bridge Security Research Lab discovered vulnerability in Feng Office, which can be exploited to perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in Feng Office: CVE-2013-5744 1.1 The vulnerability exists due to insufficient...
Multiple Vulnerabilities in BigTree CMS
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. A remote attacker can add, modify or delete information in application's database and...
Сross-Site Request Forgery (CSRF) in TestLink
High-Tech Bridge Security Research Lab has discovered vulnerabiliy in TestLink, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in TestLink: CVE-2012-2275 The application allows authorized users to perform certain actions via HTTP...
Script Insertion Vulnerability in Textpattern CMS
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Textpattern CMS which could be exploited to perform script insertion attacks. 1 Script insertion vulnerability in Textpattern CMS An input sanitation error exists in the comment field. A remote attacker can insert arbitrary...
Multiple Vulnerabilities in my little forum
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in my little forum, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. The SQL injection vulnerabilities have medium risk assigned as they can be exploited under administrator account or...
CSRF and Remote Code Execution in EGroupware
High-Tech Bridge Security Research Lab discovered CSRF and Remote Code Execution vulnerabilities in EGroupware, which can be exploited by remote attacker to gain full control over the application and compromise vulnerable system. 1 Сross-Site Request Forgery CSRF in EGroupware: CVE-2014-2987 The...
Multiple Vulnerabilities in OpenDocMan
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenDocMan, which can be exploited to perform SQL Injection and gain administrative access to the application. 1 SQL Injection in OpenDocMan: CVE-2014-1945 The vulnerability exists due to insufficient validation of...
Multiple Vulnerabilities in OpenX
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to execute arbitrary PHP code, perform Cross-Site Scripting XSS attacks and compromise vulnerable system. 1 Local File Inclusion in OpenX: CVE-2013-3514 Input passed via "group" HTTP GET...
SQL Injection in Sexy Polling Joomla Extension
High-Tech Bridge Security Research Lab discovered vulnerability in Sexy Polling Joomla Extension, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Sexy Polling Joomla Extension: CVE-2013-7219 The vulnerability exists due to insufficient validation of "answerid" HTTP POS...
Multiple Vulnerabilities in MantisBT
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in MantisBT which could be exploited to perform cross-site scripting attacks, gain access to sensitive information and compromise vulnerable system. 1 Cross-site scripting XSS vulnerabilities in MantisBT:...
Cross-site Scripting (XSS) in Saurus CMS
High-Tech Bridge SA Security Research Lab has discovered a vulnerability in Saurus CMS which could be exploited to perform cross-site scripting XSS attacks. 1 Cross-site scripting vulnerability in Saurus CMS: CVE-2010-1997 The vulnerability exists due to insufficient input sanitation in the HTTP...
Path Traversal in eduTrac
High-Tech Bridge Security Research Lab discovered path traversal vulnerability in eduTrac which can be exploited to read arbitrary files on vulnerable system with privileges of web server. 1 Path Traversal in eduTrac: CVE-2013-7097 The vulnerability exists due to insufficient filtration of...
SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin
High-Tech Bridge Security Research Lab discovered vulnerability in Wysija Newsletters WordPress plugin, which can be exploited to perform SQL Injection attacks. 1 SQL Injections in Wysija Newsletters WordPress plugin: CVE-2013-1408 The vulnerabilities exist due to insufficient filtration of...
Multiple vulnerabilities in AContent
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in AContent, which can be exploited to bypass authentication and to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 SQL Injection in AContent: CVE-2012-5167 1.1 The vulnerability exists due to insufficient...
Multiple Vulnerabilities in GRAND Flash Album Gallery
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in GRAND Flash Album Gallery which could be exploited to perform SQL injection attacks and gain access to sensitive information. 1 SQL injection vulnerabilities in GRAND Flash Album Gallery The vulnerability exists...
Two XSS vulnerabilities in Simple Security WordPress Plugin
High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Simple Security WordPress plugin, which can be exploited to perform Cross-Site Scripting attacks against administrators of WP websites with the vulnerable plugin. 1 Two Cross-Site Scripting XSS Vulnerabilities in Simple...
Cross-Site Scripting (XSS) in Revive Adserver
High-Tech Bridge Security Research Lab discovered an XSS vulnerability in Revive Adserver formerly known as OpenX Source, which can be exploited to perform Cross-Site Scripting attacks against authenticated users and administrators of the vulnerable application leading to total compromise of the...
Reflected Cross-Site Scripting (XSS) in EWWW Image Optimizer WordPress Plugin
High-Tech Bridge Security Research Lab discovered vulnerability in EWWW Image Optimizer WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin. 1 Reflected Cross-Site Scripting XSS in EWWW Image...
Two XSS in Contact Form DB WordPress plugin
High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Contact Form DB WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin installed. 1 Two Cross-Site Scripting XSS...
XSS and Full Path Disclosure in MijoSearch Joomla Extension
High-Tech Bridge Security Research Lab discovered 2 vulnerabilities in MijoSearch Joomla Extension, which can be exploited to gain access to potentially sensitive data and perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Cross-site Scripting in MijoSearch:...
Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin
High-Tech Bridge Security Research Lab discovered vulnerability in CommentLuv WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in CommentLuv wordpress plugin: CVE-2013-1409 The vulnerability exists due to insufficient filtration of...
Multiple vulnerabilities in OSclass
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OSclass, which can be exploited to perform cross-site scripting and sql injection attacks. 1 SQL Injection in OSclass: CVE-2012-0973. Input passed via the "sCategory" GET parameter to /index.php is not properly...
Cross-site Scripting (XSS) Vulnerabilities in Gollos
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Gollos which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Gollos 1.1 The vulnerability exists due to input sanitation errors in the "returnurl" paramet...
Multiple Vulnerabilities in DiamondList
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in DiamondList which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerability in DiamondList: CVE-2010-3023 1.1 The vulnerability exists due...
Cross-Site Scripting (XSS) in Ilch CMS
High-Tech Bridge Security Research Lab discovered vulnerability in Ilch CMS, which can be exploited to perform Cross-Site Scripting XSS attacks against users and administrators of vulnerable application. 1 Cross-Site Scripting XSS in Ilch CMS: CVE-2014-1944 The vulnerability exists due to...
User Identity Spoofing in Bitrix Site Manager
High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket. 1 User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788 The vulnerability exists due to...
Multiple vulnerabilities in TinyWebGallery
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in TinyWebGallery, which can be exploited to perform Сross-Site Request Forgery CSRF, Arbitrary Code Execution and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in TinyWebGallery: CVE-2012-2930...
Cross-site Request Forgery (CSRF) in Open Classifieds
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Open Classifieds which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in Open Classifieds The vulnerability exists due to insufficient validation of the request origin in...
Multiple vulnerabilities in Zikula Application Framework
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Zikula Application Framework, which can be exploited to perform cross-site scripting XSS and cross-site request forgery CSRF attacks. 1 XSRF CSRF in Zikula Application Framework: CVE-2010-1732 The vulnerability...
Reflected Cross-Site Scripting (XSS) in Google Calendar Events WordPress Plugin
High-Tech Bridge Security Research Lab discovered vulnerability in Google Calendar Events WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin. 1 Reflected Cross-Site Scripting XSS in Google Calend...