Posted by Patrick Webster via Fulldisclosure on Apr 04
Date:
04-Apr-2017
Product:
SmartJobBoard
Versions affected:
v5.0.9 and below.
Vulnerability:
1) Cross-site scripting vulnerabilities in the following locations and
parameters:
/add-listing/ [proceed_to_posting parameter]
/add-listing/ [productSID parameter]
/add-listing/Resume/General/ [productSID parameter]…
Posted by Patrick Webster via Fulldisclosure on Apr 04
Date:
04-Apr-2017
Product:
AcoraCMS
Versions affected:
7.0.0.6 (known bugs from 6.0.6 are still present
http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt).
Vulnerabilities:
1) Arbitrary browser redirect:
POST /forums/login.asp HTTP/1.1
Host: [target]
Content-Type: application/x-www-form-urlencoded
Content-Length: 70…
Posted by Patrick Webster via Fulldisclosure on Apr 04
https://www.osisecurity.com.au/kaseya-information-disclosure-vulnerability.html
Date:
04-Apr-2017
Product:
Kaseya VSA
Versions affected:
9.02.00.04
Vulnerability:
Installations of Kaseya contain the following installation page:
https://[target]/install/kaseya.html
When the product is installed, it cannot be installed again. However,
if you go to that page when it is installed, it reveals sensitive
information to the internet at large,…
Posted by Patrick Webster via Fulldisclosure on Apr 04
https://www.osisecurity.com.au/iplatinum-ioneview-multiple-parameter-reflected-xss.html
Date:
04-Apr-2017
Product:
iPlatinum iOneView
Versions affected:
Unknown.
Vulnerabilities:
1) Cross-site scripting:
http://[target]/ioneview/admin/main.pl?cmd=<script>alert(document.cookie)</script>
http://[target]/ioneview/admin/main.pl?_username="><script>alert(document.cookie)</script>…
Posted by Patrick Webster via Fulldisclosure on Apr 04
https://www.osisecurity.com.au/moodle-url-manipulation-remote-account-information-disclosure.html
Date:
04-Apr-2017
Product:
Moodle
Versions affected:
2.4.10, 2.5.6, 2.6.3, 2.7 and earlier.
Vulnerability:
Information disclosure.
Example:
/user/edit.php?id= reveals account owner name
1. Log in to http://demo.moodle.net/ as user student:sandbox.
2. Click view profile when logged in (student is id=4).
3. Change id parameter from 4 to 3, which…
Posted by DefenseCode on Apr 04
DefenseCode ThunderScan SAST Advisory
Apache Tomcat Directory/Path Traversal
Advisory ID: DC-2017-03-001
Software: Apache Tomcat
Software Language: Java
Version: 7.0.76 (probably 9, 8 and 6 branches also)
Vendor Status: Vendor contacted
Release Date: 2017-04-04
Risk: Medium
Full Advisory URL:…
Security fix for CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396.
Security fix for CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396.
Security fix for CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396.
Posted by Patrick Webster via Fulldisclosure on Apr 04
https://www.osisecurity.com.au/inchoo-facebook-connect-extension-for-magento-parameter-xss.html
Date:
04-Apr-2017
Product:
Inchoo Facebook Connect (Magento Plugin)
Vulnerability:
Reflected cross-site scripting.
Details:
Within ./app/code/community/Inchoo/Facebook/Block/Channel.php
return ‘<script src=”‘.($this->isSecure() ? ‘https://' :
‘http://&apos…