Информационная безопасность
[RU] switch to English


Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
дополнено с 16 октября 2014 г.
Опубликовано:17 октября 2014 г.
Источник:
SecurityVulns ID:14032
Тип:удаленная
Уровень опасности:
5/10
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.
Затронутые продукты:OPENCART : OpenCart 1.5
 APACHE : Syncope 1.1
 DRUPAL : Drupal 7.31
 WORDPRESS : MaxButtons 1.26
 WORDPRESS : WP Google Maps 6.0
 LIVEZILLA : LiveZilla 5.3
 JOOMLA : Kunena 3.0
 WEE : Web Encryption Extension 2.0
 MANAGEENGINE : EVENTLOG ANALYZER 9.0
 DRUPAL : Drupal 7.29
 RUBY : ruby-activerecord 3.2
 ELASTIC : Logstash 1.4
 INVISIONPOWER : IP.Board 3.4
 ALFRESCO : Alfresco Community Edition 4.2
 INFOBLOX : Network Automation 6.8
 JOOMLA : JChatSocial 2.2
 LIMESURVAY : Lime Survey 2.05
CVE:CVE-2014-7182 (Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.)
 CVE-2014-7181 (Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.)
 CVE-2014-4331 (Cross-site scripting (XSS) vulnerability in admin/viewer.php in OctavoCMS allows remote attackers to inject arbitrary web script or HTML via the src parameter.)
 CVE-2014-4326 (Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.)
 CVE-2014-3990
 CVE-2014-3863 (Cross-site scripting (XSS) vulnerability in the JChatSocial component before 2.3 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the filename parameter in a file upload in an active JChat chat window.)
 CVE-2014-3704 (The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.)
 CVE-2014-3503 (Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.)
 CVE-2014-3483 (SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.)
 CVE-2014-3482 (SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.)
 CVE-2014-3419 (Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors.)
 CVE-2014-3418 (config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.)
 CVE-2014-3149 (Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.)
Оригинальный текстdocumentMustLive, XSS vulnerabilities in Megapolis.Portal Manager (17.10.2014)
 documentStefan Horst, Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability (17.10.2014)
 documentChristian Schneider, CVE-2014-3149 - Reflected Cross-Site Scripting (XSS) in "Invision Power IP.Board" (16.10.2014)
 documentg-damore_(at)_outlook.com, Lime Survey 2-05+ Multiple Vulnerabilities (16.10.2014)
 documentTeodor Lupan, CVE-2014-3863 - Stored XSS in JChatSocial (16.10.2014)
 documentAPACHE, [SECURITY] CVE-2014-3503 Apache Syncope (16.10.2014)
 documentandreu.antonio_(at)_gmail.com, CVE-2014-4331 OctavoCMS reflected XSS vulnerability (16.10.2014)
 documentnate_(at)_depthsecurity.com, Weak Local Database Credentials in Infoblox Network Automation (16.10.2014)
 documentnate_(at)_depthsecurity.com, OS Command Injection Infoblox Network Automation (16.10.2014)
 documentSEC Consult Vulnerability Lab, SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop (16.10.2014)
 documentSEC Consult Vulnerability Lab, SEC Consult SA-20140710-1 :: Multiple high risk vulnerabilities in Shopizer webshop (16.10.2014)
 documentEgidio Romano, [KIS-2014-08] OpenCart <= 1.5.6.4 (cart.php) PHP Object Injection Vulnerability (16.10.2014)
 documentresearch_(at)_sec-consult.com., SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community Edition (16.10.2014)
 documentstormhacker_(at)_hotmail.com, IP.Board 3.4 cross-site scripting in Referer header (16.10.2014)
 documentJordan Sissel, CVE-2014-4326 Remote command execution in Logstash zabbix and nagios_nsca outputs. (16.10.2014)
 documentDEBIAN, [SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update (16.10.2014)
 documentDEBIAN, [SECURITY] [DSA 2983-1] drupal7 security update (16.10.2014)
 documentAndrea Barisani, [oCERT-2014-004] Ansible input sanitization errors (16.10.2014)
 documentaudit1_(at)_a2secure.com, Cross-site Scripting in EventLog Analyzer 9.0 build #9000 (16.10.2014)
 documentcseye_ut_(at)_yahoo.com, Multiple Vulnerabilities in Parallels® Plesk Sitebuilder (16.10.2014)
 documentjoseph.giron13_(at)_gmail.com, Easy file sharing web server - persist XSS in forum msgs (16.10.2014)
 documentSenderek Web Security, Web Encryption Extension security update (16.10.2014)
 documentvulns_(at)_dionach.com, Kunena Forum Extension for Joomla Multiple SQL Injection Vulnerabilities (16.10.2014)
 documentvulns_(at)_dionach.com, Kunena Forum Extension for Joomla Multiple Reflected Cross-Site Scripting Vulnerabilities (16.10.2014)
 documentsourav.infosec_(at)_gmail.com, LiveZilla 5.3.0.7 Security Issue (16.10.2014)
 documentHigh-Tech Bridge Security Research, Reflected Cross-Site Scripting (XSS) in MaxButtons WordPress Plugin (16.10.2014)
 documentHigh-Tech Bridge Security Research, Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin (16.10.2014)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород