Cross-Site Scripting (XSS) in BackWPup WordPress Plugin

High-Tech Bridge Security Research Lab discovered XSS vulnerability in BackWPup WordPress Plugin, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Cross-Site Scripting XSS in BackWPup WordPress Plugin: CVE-2013-4626 The vulnerabilit...

Untrusted Pointer Dereference Vulnerability in Corel WordPerfect X6

High-Tech Bridge Security Research Lab discovered an untrusted pointer dereference vulnerability in Corel WordPerfect. Opening of a malicious WPD WordPerfect Document causes immediate application crash, resulting in a loss of all unsaved current application data of the user. 1 Untrusted Pointer...

Multiple vulnerabilities in ImpressCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ImpressCMS, which can be exploited to perform cross-site scripting and local file inclusion attacks. 1 Multiple Arbitrary XSS vulnerabilities in ImpressCMS: CVE-2012-0986 1.1 Input appended to the URL after...

Multiple Cross-site Scripting Vulnerabilities in GetSimple CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in GetSimple CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting vulnerability in GetSimple CMS: CVE-2010-5052 The vulnerability exists due to input sanitation error in the "val"...

Reflected Cross-Site Scripting (XSS) in BlackCat CMS

High-Tech Bridge Security Research Lab discovered vulnerability in BlackCat CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in BlackCat CMS: CVE-2014-5259 The vulnerability exists due to insufficient sanitization of the "msg" HTTP GET...

Cross-Site Scripting (XSS) in Open Classifieds

High-Tech Bridge Security Research Lab discovered vulnerability in Open Classifieds, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Open Classifieds: CVE-2014-2024 The vulnerability exists due to insufficient sanitisation of user-supplied data...

Multiple Vulnerabilities in Horizon QCMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Horizon QCMS, which can be exploited to read contents of arbitrary files and perform SQL Injection attacks. 1 Path Traversal in Horizon QCMS: CVE-2013-7138 The vulnerability exists due to insufficient filtration of...

Cross-Site Scripting (XSS) in Zikula Application Framework

High-Tech Bridge Security Research Lab discovered vulnerability in Zikula Application Framework, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Zikula Application Framework: CVE-2013-6168 1.1 The vulnerability exists due to insufficient...

XSS Vulnerabilities in OpenCms

High-Tech Bridge Security Research Lab discovered 2 XSS vulnerabilities in OpenCms, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Multiple Cross-Site Scripting XSS in OpenCms: CVE-2013-4600 1.1 The vulnerability exists due to insufficien...

Multiple vulnerabilities in OpenX

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 Cross-Site Scripting XSS in OpenX: CVE-2012-4989 Input passed via the "parent" GET parameter to /www/admin/plugin-index.php ...

Cross-site Request Forgery (CSRF) in phpCollab

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpCollab which can be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in phpCollab 1.1 The vulnerability exists due to insufficient validation of the request origin in...

Multiple Vulnerabilities in BLOG:CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BLOG:CMS which could be exploited to perform cross-site scripting, script insertion and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in BLOG:CMS: CVE-2010-4749 1.1 The...

Directory Traversal Vulnerability in SoftX FTP Client

High-Tech Bridge SA Security Research Lab has discovered vulnerability in SoftX FTP Client which could be exploited to execute arbitrary code on vulnerable system. 1 Directory Traversal Vulnerability in SoftX FTP Client: CVE-2010-3096 The vulnerability exists due to insufficient sanitation of the...

Multiple Vulnerabilities in boastMachine

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in boastMachine which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in applications database. 1 Cross-site scripting XSS vulnerability in boastMachine The vulnerability...

SQL Injection Vulnerability in ArticleFR

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in ArticleFR, which can be exploited to perform SQL Injection attacks and gain complete control over vulnerable website. 1 SQL Injection in ArticleFR: CVE-2014-5097 The vulnerability exists due to insufficient...

Improper Access Control in ArticleFR

High-Tech Bridge Security Research Lab discovered vulnerability in ArticleFR, which can be exploited to execute arbitrary UPDATE SQL statements, alter information stored in database and gain complete control over the web site. 1 Improper Access Control in ArticleFR: CVE-2014-4170 The vulnerabilit...

Сross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in AskApache Firefox Adsense Wordpress plugin, which can be exploited to perform Сross-Site Request Forgery CSRF attacks. 1 Сross-Site Request Forgery CSRF in AskApache Firefox Adsense Wordpress plugin: CVE-2013-6992 The vulnerabilit...

Multiple Vulnerabilities in LibreOffice

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LibreOffice which could be exploited to perform denial of service DoS attacks. 1 Multiple vulnerabilities in LibreOffice: CVE-2012-4233 1.1 NULL pointer dereference error was found in the vcllo.dll while processi...

Cross-site Scripting (XSS) Vulnerability in FlatPress

High-Tech Bridge SA Security Research Lab has discovered vulnerability in FlatPress which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in FlatPress The vulnerability exists due to input sanitation error in the "name", "email" and "url"...

SQL Injection Vulnerability in ExtCalendar 2

High-Tech Bridge SA Security Research Lab has discovered vulnerability in ExtCalendar 2 which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerability in ExtCalendar 2 The vulnerability exists due to input sanitation errors in the "search" parameter in calsearch.php. A...

Cross-site Scripting (XSS) Vulnerability in PhotoSmash

High-Tech Bridge SA Security Research Lab has discovered vulnerability in PhotoSmash WordPress plugin which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in PhotoSmash The vulnerability exists due to input sanitation error in the "action"...

SQL Injection Vulnerabilities in WP Forum wordpress plugin

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WP Forum wordpress plugin which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerabilities in WP Forum wordpress plugin 1.1 The vulnerability exists due to input sanitation error in the...

Multiple Vulnerabilities in VaM Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in VaM Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in VaM Shop: CVE-2011-0504 1.1 The vulnerability exists due to...

Cross-site Scripting (XSS) Vulnerability in NinkoBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in NinkoBB which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in NinkoBB: CVE-2010-4874 The vulnerability exists due to input sanitation error in parameters...

Сross-Site Request Forgery (CSRF) in XCloner Standalone

High-Tech Bridge Security Research Lab discovered vulnerability in XCloner Standalone, which can be exploited to perform Сross-Site Request Forgery CSRF attacks and gain complete control over the website. 1. Сross-Site Request Forgery CSRF in XCloner Standalone: CVE-2014-2579 1.1 The vulnerabilit...

SQL Injection in Dolphin | HTB23157

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Dolphin, which can be exploited to manipulate SQL requests passed to vulnerable application and obtain sensitive data from the database. 1 SQL Injection in Dolphin: CVE-2013-3638 The vulnerability exists due to...

Path Traversal in AWS XMS

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in AWS XMS, which can be exploited to read contents of arbitrary files. 1 Path Traversal in AWS XMS: CVE-2013-2474 The vulnerability exists due to insufficient filtration of "what" HTTP GET parameter passed to...

Multiple XSS vulnerabilities in Events Manager WordPress plugin

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Events Manager WordPress plugin, which can be exploited to perform Cross-Site Scripting attacks. 1 Multiple XSS vulnerabilities in Events Manager WordPress plugin: CVE-2013-1407 1.1 The vulnerability exists due to...

Multiple vulnerabilities in dotProject

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in dotProject, which can be exploited to perform SQL injection and cross-site scripting XSS attacks. 1 SQL Injection in dotProject: CVE-2012-5701 High-Tech Bridge Security Research Lab has discovered multiple SQL injection...

Multiple vulnerabilities in TCExam

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TCExam, which can be exploited to perform Cross-Site Scripting XSS and SQL injection attacks. 1 SQL Injection in TCExam: CVE-2012-4601 1.1 Input passed via the "usergroups" POST parameter to /admin/code/tceedittest.php ...

Blind SQL Injection in Webmatic

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Webmatic, which can be exploited to perform Blind SQL Injection attacks. 1 Blind SQL Injection in Webmatic: CVE-2012-3350 1.1 Input passed via the "Referer:" field of the HTTP header to index.php is not properly sanitised...

Multiple vulnerabilities in Pligg CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pligg CMS , which can be exploited to perform Cross-Site Scripting XSS and Local File Inclusion attacks. 1 Multiple Cross-Site Scripting XSS in Pligg CMS: CVE-2012-2436 1.1 Input passed via the arbitrary any GET...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...

Installation Path Disclosure Weakness in Enano CMS

High-Tech Bridge SA Security Research Lab has discovered a weakness in Enano CMS which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in Enano CMS: CVE-2010-4781 The weakness exists due to application reveals the full path to...

Multiple Vulnerabilities in LiSK CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LiSK CMS which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in applications database. 1 Cross-site scripting XSS vulnerability in LiSK CMS: CVE-2010-2013 The...

Self-XSS in Microsoft Dynamics CRM 2013 SP1

High-Tech Bridge Security Research Lab discovered a DOM-based self-XSS vulnerability in Microsoft Dynamics CRM 2013 SP1, which can be exploited to perform Cross-Site Scripting attacks against authenticated users. The vulnerability exists due to insufficient filtration of user-supplied input passe...

SQL Injection in Cotonti

High-Tech Bridge Security Research Lab discovered vulnerability in Cotonti, which can be exploited to perform SQL injection attacks against vulnerable application. A remote attacker can read, modify or delete data in application’s database and even gain complete control over the application under...

SQL Injection in b2evolution

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. 1 SQL Injection in b2evolution: CVE-2013-2945 The vulnerability exists due to insufficient validation of HTTP...

OS Command Injection in CosCms

High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted. 1 OS Command Injection in CosCms: CVE-2013-1668 Vulnerability exists due to insufficient validation of...

Cross-Site Scripting (XSS) vulnerability in Quick.Cms and Quick.Cart

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Quick.Cms and Quick.Cart - two products developed by OpenSolution team, which can be exploited to perform cross-site scripting attacks. 1. Cross-Site Scripting XSS vulnerability in Quick.Cms and Quick.Cart: CVE-2012-6430 The...

Multiple SQL Injection Vulnerabilities in Elite Bulletin Board

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Elite Bulletin Board, which can be exploited to perform SQL injection attacks. 1 Multiple SQL injection vulnerabilities in Elite Bulletin Board: CVE-2012-5874 The vulnerabilities exist due to insufficient sanitation of...

Multiple vulnerabilities in jCore

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in jCore, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 SQL Injection in jCore: CVE-2012-4232 1.1 Input passed via the "memberloginid" COOKIE parameter to /admin/index.php is not...

Multiple vulnerabilities in Piwigo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Cross-Site Scripting XSS and Path Traversal attacks. 1 Directory Path Traversal in Piwigo: CVE-2012-2208 1.1 Input passed via the "language" GET parameter to upgrade.php ...

2 Buffer Overflows in Wireless Manager Sony VAIO

High-Tech Bridge SA Security Research Lab has discovered 2 buffer overflow vulnerabilities in Wireless Manager Sony VAIO which can be exploited to execute arbitrary code on vulnerable system. 1 Buffer Overflow in Wireless Manager Sony VAIO: CVE-2012-0985 1.1 The method SetTmpProfileOption in...

Buffer Overflow in HP Device Access Manager for Protect Tools Information Store

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in HP Device Access Manager for Protect Tools Information Store which could be exploited to compromise vulnerable system. 1 Buffer overflow in HP Device Access Manager for Protect Tools Information Store: CVE-2011-4162 The...

Cross-site Request Forgery (CSRF) Vulnerabilities in Argyle Social

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Argyle Social which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF vulnerabilities in Argyle Social 1.1 The vulnerability exists due to insufficient validation...

Multiple Vulnerabilities in poMMo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in poMMo which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in poMMo 1.1 The vulnerability exists due to input sanitation erro...

SQL Injection Vulnerability in Enano CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Enano CMS which could be exploited to execute arbitrary SQL commands in applications database. 1 SQL injection vulnerability in Enano CMS: CVE-2010-4780 An input validation error exists in the way application handles users...

Cross-site Request Forgery (CSRF) in Open blog

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Open blog which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery vulnerabilities in Open blog: CVE-2010-3025 1.1 The vulnerability exists due to insufficient validati...

Reflected Cross-Site Scripting (XSS) in MaxButtons WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in MaxButtons WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against logged-in administrator. 1 Reflected Cross-Site Scripting XSS in MaxButtons wordpress plugin: CVE-2014-7181 Input passed via t...