Информационная безопасность
[RU] switch to English


Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
Опубликовано:24 октября 2010 г.
Источник:
SecurityVulns ID:11207
Тип:удаленная
Уровень опасности:
5/10
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.
Затронутые продукты:WAGORA : W-Agora 4.1
 TYPO3 : typo3 4.3
 DELUXEBB : DeluxeBB 1.3
 TRIBIQ : Tribiq CMS 5.2
 4SITE : 4site CMS 2.4
 SNEWS : sNews 1.7
 SAWMILL : Sawmill 8.1
 PECIOCMS : Pecio CMS 2.0
 MICROCMS : Micro CMS 1.0
 WICCLE : Wiccle Web Builder CMS 2.0
CVE:CVE-2010-3717 (The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string, a related issue to CVE-2010-3710.)
 CVE-2010-3716 (The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships.)
 CVE-2010-3715 (Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.)
 CVE-2010-3714 (The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.)
Оригинальный текстdocumentYam Mesicka, Aardvark Topsite XSS vulnerability (24.10.2010)
 documentMustLive, Уязвимости в W-Agora (24.10.2010)
 documentDEBIAN, [SECURITY] [DSA 2121-1] New TYPO3 packages fix several vulnerabilities (24.10.2010)
 documentSecPod Research, Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple XSS Vulnerabilities (24.10.2010)
 documentSecPod Research, Pecio CMS XSS Vulnerability (24.10.2010)
 documentSecPod Research, Micro CMS Persistent XSS Vulnerability. (24.10.2010)
 documentSEC Consult Vulnerability Lab, SEC Consult SA-20101021-0 :: Multiple critical vulnerabilities in Sawmill log analysis software (24.10.2010)
 documentHigh-Tech Bridge Security Research, XSS vulnerability in sNews (24.10.2010)
 documentHigh-Tech Bridge Security Research, XSS vulnerability in sNews (24.10.2010)
 documentHigh-Tech Bridge Security Research, SQL Injection in 4site CMS (24.10.2010)
 documentHigh-Tech Bridge Security Research, Path disclosure in Tribiq CMS (24.10.2010)
 documentHigh-Tech Bridge Security Research, SQL injection in DeluxeBB (24.10.2010)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород