osTicket is affected by multiple input validation vulnerabilities due to a failure in the application to properly sanitize user-supplied input. Reportedly the application permits the inclusion of remote code that could be run under the permissions of the affected Web server. The application is vulnerable to multiple cross-site scripting vulnerabilities, which could allow for theft of cookie-based authentication credentials. If the file upload feature is enabled then a directory traversal vulnerability is possible, which could be exploited to retrieve sensitive or privileged information normally accessible to the Web server. The application is also prone to HTML injection and multiple SQL injection vulnerabilities, which could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The Mtp-Target server is prone to a memory corruption vulnerability. The issue exists because a comparison fails to ensure that an integer value parameter retrieved from a client is signed. A check is made to ensure that the user-supplied value is less than 1000000 bytes. If the value passed is FFFFFFFFh, it is interpreted as a signed -1 and the check passes. The value is later used as an unsigned integer in a memory allocation operation. An allocation of 4.29 GB of data is attempted and the service crashes.
ViArt Shop is affected by multiple cross-site scripting and HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
ViArt Shop is affected by multiple cross-site scripting and HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Mtp-Target Client is vulnerable to a remote format string vulnerability due to a failure of the application to securely call a formatted printing function. An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that activated the vulnerable client application.
Video Cam Server fails to control access to the administrative interface, allowing an attacker to gain access to the administrative interface without authentication.
Video Cam Server is prone to a path disclosure issue when invalid data is submitted. This issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.
JGS-Portal is prone to an SQL injection. This issue may potentially be exploited to compromise the software or gain unauthorized access to the database. The consequences of exploitation will depend on the nature of the vulnerable SQL query and the capabilities of the underlying database implementation.
PHPCoin is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Services By CQR