CVE-2008-2335 - Vastal I-tech phpVID 1.2.3 Multiple XSS (Cross-site Scripting) Web Security Vulnerabilities

CVE-2008-2335 - Vastal I-tech phpVID 1.2.3 Multiple XSS (Cross-site Scripting) Web Security Vulnerabilities

Exploit Title: Vastal I-tech phpVID Multiple XSS Security Vulnerabilities

Product: phpVID

Vendor: Vastal I-tech

Vulnerable Versions: 1.2.3   0.9.9

Tested Version: 1.2.3   0.9.9

Advisory Publication: March 10, 2015

Latest Update: March 10, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2008-2335

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:


(1) Vendor & Product Description:


Vendor:
Vastal I-tech



Product & Vulnerable Versions:
phpVID
1.2.3
0.9.9



Vendor URL & Download:
phpVID can be bought from here,
http://www.vastal.com/phpvid-the-video-sharing-software.html#.VP7aQ4V5MxA



Product Introduction:
"phpVID is a video sharing software or a video shating script and has all the features that are needed to run a successful video sharing website like youtube.com. The features include the following. phpVID is the best youtube clone available. The latest features include the parsing of the subtitles file and sharing videos via facebook. With phpVID Video Sharing is extremely easy. "

"The quality of code and the latest web 2.0 technologies have helped our customers to achieve their goals with ease. Almost all customers who have purchased phpVID are running a successful video sharing website. The quality of code has helped in generating more then 3 million video views a month using a "single dedicated server". phpVID is the only software in market which was built in house and not just purchased from someone. We wrote the code we know the code and we support the code faster then anyone else. Have any questions/concerns please contact us at: info@vastal.com. See demo at: www.phpvid.com. If you would like to see admin panel demo please email us at: info@vastal.com."

"Server Requirements:
Preferred Server: Linux any Version
PHP 4.1.0 or above
MySQL 3.1.10 or above
GD Library 2.0.1 or above
Mod Rewrite and .htaccess enabled on server.
FFMPEG (If you wish to convert the videos to Adobe Flash)"





(2) Vulnerability Details:
phpVID web application has a security bug problem. It can be exploited by XSS (Cross-site Scripting) attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Some bug hunter researchers also have found other XSS vulnerabilities related to it before. phpVID has patched some of them.


(2.1) The first code programming flaw occurs at "members.php?" page with "&browse" parameter.


(2.2) The second code programming flaw occurs at "login.php?" page with "&next" parameter.


(2.3) The third code programming flaw occurs at "search_results.php?" page with "&query" parameter.


(2.4) The fourth code programming flaw occurs at "groups.php?" page with "&type" parameter.










References:
http://www.tetraph.com/security/xss-vulnerability/vastal-i-tech-phpvid-1-2-3-multiple-xss
http://securityrelated.blogspot.com/2015/03/vastal-i-tech-phpvid-123-multiple-xss.html
http://www.inzeed.com/kaleidoscope/computer-web-security/vastal-i-tech-phpvid-1-2-3
http://diebiyi.com/articles/security/vastal-i-tech-phpvid-1-2-3-multiple
https://cxsecurity.com/issue/WLB-2015030026
http://computerobsess.blogspot.com/2015/09/vastal-xss.html
https://hackertopic.wordpress.com/2015/08/13/vastal-xss/
http://lists.openwall.net/full-disclosure/2015/03/10/9
http://tetraph.blog.163.com/blog/static/234603051201584111058296/
http://marc.info/?l=full-disclosure&m=142601091100720&w=4
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1700

CVE-2014-9558 SmartCMS Multiple SQL Injection Security Vulnerability

CVE-2014-9558 SmartCMS Multiple SQL Injection Security Vulnerability

Exploit Title: Smartwebsites SmartCMS v.2 Multiple SQL Injection Security Vulnerabilities
Product: SmartCMS v.2
Vendor: Smartwebsites
Vulnerable Versions: v.2
Tested Version: v.2
Advisory Publication: Jan 22, 2015
Latest Update: Jan 22, 2015
Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89)
CVE Reference: CVE-2014-9558
CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
Credit: Wang Jing [MAS, Nanyang Technological University (NTU), Singapore]

Advisory Details:

(1) Vendor & Product Description

Vendor: Smartwebsites

Product & Version: SmartCMS v.2

Vendor URL & Download:

http://www.smartwebsites.com.cy/index.php?pageid=13&lang=en

Product Description:

“SmartCMS is one of the most user friendly and smart content management systems there is in the Cyprus market. It makes the content management of a webpage very easy and simple, regardless of the user’s technical skills.”

(2) Vulnerability Details:

SmartCMS v.2 has a security vulnerability. It can be exploited by SQL Injection attacks.

(2.1) The first vulnerability occurs at “index.php?” page with “pageid” “lang” multiple parameters.

(2.2) The second vulnerability occurs at “sitemap.php?” page with “pageid” “lang” multiple parameters.

References:

http://www.tetraph.com/security/cves/cve-2014-9558-smartcms-sql-injection-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9558

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1501

http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-201501-607

http://packetstormsecurity.com/files/130075/SmartCMS-2-SQL-Injection.html

http://webtechhut.blogspot.com/2015/02/cve-2014-9558-smartcms-multiple-sql.html

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9558

https://biyiniao.wordpress.com/2015/02/11/cve-2014-9558-smartcms-multiple-sql-injection-security-vulnerability/

http://xforce.iss.net/xforce/xfdb/100332

http://lifegrey.tumblr.com/post/110700573094/ithut-cve-2014-9558-smartcms-multiple-sql

http://milw00rm.com/exploits/6672

http://guyuzui.lofter.com/post/1ccdcda4_5c409ca

http://www.inzeed.com/kaleidoscope/cves/cve-2014-9558-smartcms-multiple-sql-injection-security-vulnerability/

http://whitehatpost.blog.163.com/blog/static/242232054201511112757529/

CVE-2014-9557 SmartCMS Multiple XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-9557 SmartCMS Multiple XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Smartwebsites SmartCMS v.2 Multiple XSS Security Vulnerabilities
Product: SmartCMS v.2
Vendor: Smartwebsites
Vulnerable Versions: v.2
Tested Version: v.2
Advisory Publication: Jan 22, 2015
Latest Update: Jan 22, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-9557
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [MAS, Nanyang Technological University (NTU), Singapore]

Advisory Details:

(1) Vendor & Product Description

Vendor: Smartwebsites

Product & Version: SmartCMS v.2

Vendor URL & Download:

http://www.smartwebsites.com.cy/index.php?pageid=13&lang=en

Product Description: “SmartCMS is one of the most user friendly and smart content management systems there is in the Cyprus market. It makes the content management of a webpage very easy and simple, regardless of the user’s technical skills.”

(2) Vulnerability Details:

SmartCMS v.2 has a security vulnerability. It can be exploited by XSS attacks.

(2.1) The first vulnerability occurs at “index.php?” page with “pageid” “lang” multiple parameters.

(2.2) The second vulnerability occurs at “sitemap.php?” page with “pageid” “lang” multiple parameters.

References:

http://www.tetraph.com/security/cves/cve-2014-9557-smartcms-multiple-xss-cross-site-scripting-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9557

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9557

http://packetstormsecurity.com/files/130076/SmartCMS-2-Cross-Site-Scripting.html

http://en.hackdig.com/?13971.htm

http://cxsecurity.com/issue/WLB-2015010130

https://hackertopic.wordpress.com/2015/02/11/cve-2014-9557-smartcms-multiple-xss-cross-site-scripting-security-vulnerability/

http://cve.scap.org.cn/CVE-2014-9557.html

http://securitypost.tumblr.com/post/110696783722/itinfotech-cve-2014-9557-smartcms-multiple-xss

http://exploitarchive.com/smartcms-2-cross-site-scripting/

http://webtechhut.blogspot.com/2015/02/cve-2014-9557-smartcms-multiple-xss.html

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1502

http://blog.163.com/greensun_2006/blog/static/11122112201511105129826/

http://itsecurity.lofter.com/post/1cfbf9e7_5c3a4a8

CVE-2014-9559 SnipSnap XSS (Cross-Site Scripting) Security Vulnerabilities

CVE-2014-9559 SnipSnap XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: SnipSnap /snipsnap-search? query Parameter XSS

Product: SnipSnap

Vulnerable Versions: 0.5.2a  1.0b1  1.0b2

Tested Version: 0.5.2a  1.0b1  1.0b2

Advisory Publication: Jan 30, 2015

Latest Update: Jan 30, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9559

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Credit: Wang Jing [MAS, Nanyang Technological University (NTU), Singapore]

Advisory Details:

(1) Vendor & Product Description

Vendor: 

SnipSnap

Product & Version: 

SnipSnap

0.5.2a

1.0b1

1.0b2

Vendor URL & Download:

http://snipsnap.org

Product Description: 

“SnipSnap is a user friendly content management system with features such as wiki and weblog. “

(2) Vulnerability Details:

SnipSnap has a security problem. It can be exploited by XSS attacks.

(2.1) The vulnerability occurs at “snipsnap-search?” page with “query” parameter.

References:

http://www.securityfocus.com/bid/72397

http://www.cvedetails.com/cve/CVE-2014-9559/

http://seclists.org/fulldisclosure/2015/Feb/1

http://tetraph.com/security/cves/cve-2014-9559-snipsnap-xss-cross-site-scripting-security-vulnerabilities/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9559

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9559

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1539

http://static-173-79-223-25.washdc.fios.verizon.net/?a=139222176300014&r=1&w=2

http://ittechnology.lofter.com/post/1cfbf60d_5c34005

http://lists.kde.org/?a=139222176300014&r=1&w=2

http://itinfotech.tumblr.com/post/110692217346/securitypost-cve-2014-9559-snipsnap-xss

http://marc.info/?a=139222176300014&r=1&w=4

https://webtechwire.wordpress.com/2015/02/11/cve-2014-9559-snipsnap-xss-cross-site-scripting-security-vulnerabilities/

http://itprompt.blogspot.com/2015/02/cve-2014-9559-snipsnap-xss-cross-site.html

CVE-2014-8490 TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-8490  TennisConnect COMPONENTS System XSS (Cross-Site Scripting) Security Vulnerability


Exploit Title: TennisConnect "TennisConnect COMPONENTS System" /index.cfm pid Parameter XSS
Product: TennisConnect COMPONENTS System
Vendor:    TennisConnect
Vulnerable Versions: 9.927
Tested Version:    9.927
Advisory Publication: Nov 18, 2014
Latest Update:    Nov 18, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8490
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Credit: Wang Jing [CCRG, Nanyang Technological University, Singapore]







Advisory Details:

(1) Vendor URL:
http://www.tennisconnect.com/products.cfm#Components

Product Description:
TennisConnect COMPONENTS
* Contact Manager (online player database)
* Interactive Calendar including online enrollment
* League & Ladder Management through Tencap Tennis
* Group Email (including distribution lists, player reports, unlimited sending volume and frequency)
* Multi-Administrator / security system with Page Groups
* Member Administration
* MobileBuilder
* Online Tennis Court Scheduler
* Player Matching (Find-a-Game)
* Web Site Builder (hosted web site and editing tools at www. your domain name .com)



(2) Vulnerability Details.
TennisConnect COMPONENTS System has a security problem. It is vulnerable to XSS attacks.
(2.1) The vulnerability occurs at "/index.cfm?" page, with "&pid" parameter.








References:
http://packetstormsecurity.com/files/129662/TennisConnect-9.927-Cross-Site-Scripting.html
http://tetraph.com/security/cves/cve-2014-8490-tennisconnect-components-system-xss-cross-site-scripting-security-vulnerability/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8490
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8490
http://www.osvdb.org/show/osvdb/116149
http://cve.scap.org.cn/CVE-2014-8490.html
http://en.hackdig.com/?11701.htm
http://itsecurity.lofter.com/
http://seclists.org/fulldisclosure/2014/Dec/83
http://securitypost.tumblr.com/
http://computerobsess.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-8490-tennisconnect-components-system-xss-cross-site-scripting-security-vulnerability/
http://whitehatpost.blog.163.com/blog/static/2422320542015110102316210/#
http://tetraph.blogspot.com/2015/02/cve-2014-8490-tennisconnect-components.html
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1352

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: JCE-Tech "Video Niche Script" /view.php Multiple Parameters XSS

Product: "Video Niche Script"

Vendor: JCE-Tech

Vulnerable Versions: 4.0

Tested Version: 4.0

Advisory Publication: Nov 18, 2014

Latest Update: Nov 18, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8752

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6 

Credit: Wang Jing [CCRG, Nanyang Technological University, Singapore]

Advisory Details:

(1) Vendor URL:

http://jce-tech.com/products/

Product Description:

"The PHP Video Script instantly creates a niche video site based on keywords users control via the admin console. The videos are displayed on users' site, but streamed from the YouTube servers."

(2) Vulnerability Details.

JCE-Tech "Video Niche Script" has a security problem. It is vulnerable to XSS attacks.

(2.1) The vulnerability occurs at "view.php" page with "video", "title" parameter.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8752

http://tetraph.com/security/cves/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8752

http://seclists.org/fulldisclosure/2014/Dec/84

http://www.securityfocus.com/bid/71738

http://www.intelligentexploit.com/view-details.html?id=20454

http://packetstormsecurity.com/files/129661/JCE-Tech-4.0-Cross-Site-Scripting.html

http://itinfotech.tumblr.com/

http://en.hackdig.com/?11701.htm

http://www.inzeed.com/kaleidoscope/xss-vulnerability/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/

http://ittechnology.lofter.com/

http://user.qzone.qq.com/2519094351/2

http://whitehatpost.blog.163.com/blog/static/242232054201511095133273/#

https://tetraph.wordpress.com/2015/02/10/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/

CVE-2014-9561 Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-9561  Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter XSS

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9561

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

Advisory Details:
Vendor URL:
http://www.softbb.net/


(2) Vulnerability Details:
Softbb.net SoftBB can be exploited by XSS Attacks.
(2.1) The vulnerability occurs at “/redir_last_post_list.php” page, with “&post” parameter.

References:

http://tetraph.com/security/cves/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9561

http://www.cnvd.org.cn/flaw/show/CNVD-2015-00352

http://cve.scap.org.cn/CVE-2014-9561.html

http://packetstormsecurity.com/files/author/11270/

http://seclists.org/fulldisclosure/2015/Jan/21
http://blog.163.com/greensun_2006/blog/static/1112211220151105202951/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9561

http://en.hackdig.com/wap/?id=12956

http://static-173-79-223-25.washdc.fios.verizon.net/?a=139222176300014&r=1&w=2
http://mathswift.blogspot.com/2015/02/cve-2014-9561-softbbnet-softbb-xss.html

http://lists.kde.org/?a=139222176300014&r=1&w=2

http://marc.info/?a=139222176300014&r=1&w=4
https://itinfotechnology.wordpress.com/2015/02/10/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerability

CVE-2014-9560  Softbb.net SoftBB SQL Injection Security Vulnerability

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter SQL Injection

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89)

CVE Reference: CVE-2014-9560

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

Advisory Details:
Vendor URL:
http://www.softbb.net/



(2) Vulnerability Details:
Softbb.net SoftBB can be exploited by SQL Injection attacks.

(2.1) The vulnerability occurs at “/redir_last_post_list.php” page, with “&post” parameter.

References:

http://tetraph.com/security/cves/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9560

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9560

http://seclists.org/fulldisclosure/2015/Jan/20

http://packetstormsecurity.com/files/129888/SoftBB-0.1.3-SQL-Injection.html

https://cxsecurity.com/issue/WLB-2015010053

http://www.securityfocus.com/bid/71986

http://www.cnvd.org.cn/flaw/show/CNVD-2015-00351

http://www.intelligentexploit.com/view-details.html?id=20557

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1425

http://milw00rm.net/exploits/6367
http://computerobsess.blogspot.com/2015/02/cve-2014-9560-softbbnet-softbb-sql.html 
http://whitehatpost.blog.163.com/blog/static/24223205420151104309866/#

https://vulnerabilitypost.wordpress.com/2015/02/10/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerabilities/

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]





http://www.inzeed.com/kaleidoscope/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability/

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: Dec 09, 2014

Latest Update: Dec 09, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Security Vulnerability

















Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Security Vulnerability
Product: WordPress Ad-Manager Plugin
Vendor: CodeCanyon
Vulnerable Versions: 1.1.2
Tested Version: 1.1.2
Advisory Publication: Nov 25, 2014
Latest Update: Nov 25, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8754
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]





http://seclists.org/fulldisclosure/2014/Nov/93

CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-7291  Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Springshare LibCal Multiple XSS (Cross-Site Scripting) Vulnerability

Product: LibCal

Vendor: Springshare

Vulnerable Versions: 2.0

Tested Version: 2.0

Advisory Publication: Nov 25, 2014

Latest Update: Nov 25, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-7291

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Solution Status: Fixed by Vendor

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

https://computertechhut.wordpress.com/2014/12/29/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-security-vulnerability/

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Security Vulnerability

 

Exploit Title: Newtelligence dasBlog Dest Redirect Privilege Escalation Vulnerability
Product: dasBlog
Vendor:    Newtelligence
Vulnerable Versions: 2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)
Tested Version: 2.3 (2.3.9074.18820)
Advisory Publication: OCT 15, 2014
Latest Update:    OCT 15, 2014
Vulnerability Type: Open Redirect [CWE-601]
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://seclists.org/fulldisclosure/2014/Oct/91

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability



Bugtraq ID:     70654
Class:     Input Validation Error
CVE:     CVE-2014-7292
Remote:     Yes
Local:     No
Published:     Oct 20 2014 12:00AM
Updated:     Oct 20 2014 12:00AM
Credit:     Wang Jing

http://www.securityfocus.com/bid/70654

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

CVE-2014-8751  goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: Dec 09, 2014

Latest Update: Dec 09, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

Advisory Details:

(1) Product

“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself.”

(2) Vulnerability Details:

goYWP WebPress has a security problem. It is vulnerable to XSS attacks.

(2.1) The first security vulnerability occurs at “/search.php” page with “&search_param” parameter in HTTP GET.

(2.2) The second security vulnerability occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.

References:

http://seclists.org/fulldisclosure/2014/Dec/34

http://www.cnvd.org.cn/flaw/show/CNVD-2014-09095

http://cxsecurity.com/issue/WLB-2014120057

http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html

http://marc.info/?l=full-disclosure&m=141815910228867&w=4

http://tetraph.com/security/cves/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

http://www.scap.org.cn/CVE-2014-8751.html

http://advisories75.rssing.com/chan-6966477/all_p243.html#item4845

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

https://computertechhut.wordpress.com/2014/12/29/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

Security-Bug: Facebook- und Google-Login unsicher

Security-Bug: Facebook- und Google-Login unsicher

Der nächste Hammer nach dem OpenSSL-Bug: Die sehr weit verbreiteten Login-Protokolle OpenID und OAuth 2.0 haben eine Sicherheitslücke, über die Angreifer an vertrauliche Daten der Nutzer gelangen können. Dies fand Wang Jing, ein Student der Nanyang Technological University in Singapur, heraus. Betroffen sind diverse große Webdienste, die auf diese Protokolle setzen, zum Beispiel Google, Facebook, Microsoft und PayPal.











Sicherheitsrisiko: Login via Facebook oder Google sind angreifbar


OpenID und OAuth, wie OpenSSL Open-Source-Anwendungen, dienen als Login-Methode für Webdienste und Apps. User können sich darüber mit einem bestehenden Konto (etwa von Facebook oder Google) bei dem Dienst registrieren, ohne dort ein eigenes Benutzerkonto anlegen zu müssen. Ähnlich funktioniert auch die Anmeldung bei Facebook-Apps. In beiden Fällen hat der User den Vorteil, dass seine Anmeldedaten bei Google oder Facebook bleiben, der neue Dienst also weder E-Mail-Adresse noch Passwort erhält.


http://www.chip.de/news/Security-Bug-Facebook-und-Google-Login-unsicher_69512331.html