SIGMA Lite & Lite + Security Vulnerabilities

CVE-2005-3876

Multiple SQL injection vulnerabilities in adcbrowres.php in AD Center ADC2000 NG Pro 1.2 and NG Pro Lite allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) lang...

ADC2000 NG Pro SQL inj. vuln.

ADC2000 NG Pro SQL inj. vuln. Vuln. dicovered by : r0t Date: 27 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/adc2000-ng-pro-sql-inj-vuln.html vendor:http://www.td-systems.com/products/ affected version: 1.2 and ADC2000 NG Pro Lite Product Description: AD Center 2000 NG Pro is a...

CVE-2005-3850

Cross-site scripting (XSS) vulnerability in search.asp in Online Knowledge Base System (OKBSYS) Lite Edition 1.0 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the q...

CVE-2005-3851

Cross-site scripting (XSS) vulnerability in search.asp in Online Attendance System (OASYS) Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via certain search parameters, possibly the keyword...

CVE-2005-3852

SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword...

CVE-2005-3850

Cross-site scripting (XSS) vulnerability in search.asp in Online Knowledge Base System (OKBSYS) Lite Edition 1.0 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the q...

CVE-2005-3851

Cross-site scripting (XSS) vulnerability in search.asp in Online Attendance System (OASYS) Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via certain search parameters, possibly the keyword...

CVE-2005-3852

SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword...

CVE-2005-3852

SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword...

CVE-2005-3850

Cross-site scripting (XSS) vulnerability in search.asp in Online Knowledge Base System (OKBSYS) Lite Edition 1.0 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the q...

CVE-2005-3851

Cross-site scripting (XSS) vulnerability in search.asp in Online Attendance System (OASYS) Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via certain search parameters, possibly the keyword...

Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks,...

OASYS Lite 1.0 "search.asp" XSS vuln.

OASYS Lite 1.0 "search.asp" XSS vuln. Vuln. dicovered by : r0t Date: 25 nov. 2005 Original advisory:http://pridels.blogspot.com/2005/11/oasys-lite-10-searchasp-xss-vuln.html Vendor:www.onlinetechtools.com Product link:http://www.onlinetechtools.com/products/oasyslite/ affected vesion: 1.0 and...

OKBSYS Lite 1.0 "search.asp" XSS vuln.

Online Knowledge Base System: Lite Edition 1.0 XSS vuln. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/okbsys-lite-10-searchasp-xss-vuln.html Vendor:www.onlinetechtools.com Product link:http://www.onlinetechtools.com/products/okbsys/ affected...

OWOS Lite 3.0 SQL inj.

Online Work Order Suite: Lite Edition for ASP 3.0 SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/owos-lite-30-sql-inj.html Vendor:www.onlinetechtools.com Product link:http://www.onlinetechtools.com/products/owoslite/ affected vesion:3.0...

CVE-2005-3697

Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in...

Trojan horses

An unknown service runs on this port. It is sometimes opened by Trojan horses. Unless you know for sure what is behind it,...

Directory Scanner

This plugin attempts to determine the presence of various common dirs on the remote web...

Comersus BackOffice Lite Administrative Bypass

Comersus ASP shopping cart is a set of ASP scripts creating an online shoppingcart. It works on a database of your own choosing, default is msaccess, and includes online administration...

CVE-2005-3020

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to language.php, (5) orderby.....

CVE-2005-3022

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid parameter to cronlog.php,....

CVE-2005-3019

Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5)...

CVE-2005-3023

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) announcement.php, (2) admincalendar.php, (3) bbcode.php, (4) cronadmin.php, (5) email.php, (6) faq.php, (7) forum.php, (8)...

CVE-2005-3021

image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload...

CVE-2005-3024

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to user.php, the (5)...

CVE-2005-3025

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php, or the ip parameter to (3) modcp/user.php or (4)...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/language.php?goto' Cross-Site Scripting

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertools.php?ids' SQL Injection

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/index.php' Multiple Cross-Site Scripting Vulnerabilities

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php' Multiple SQL Injections

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertitle.php?usertitleid' SQL Injection

...

vBulletin 1.0.1 lite/2.x/3.0 - 'joinrequests.php?request' SQL Injection

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/css.php?group' Cross-Site Scripting

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/template.php' Multiple Cross-Site Scripting Vulnerabilities

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/modlog.php?orderby' Cross-Site Scripting

...

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php?email' Cross-Site Scripting

...

CVE-2005-2951

Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include_once...

JVN#97422426 Hyper NIKKI System cross-site request forgery vulnerability

Impact If a weblog administrator accesses a malicious web page, an attacker could add, alter, or delete the weblog text. If the weblog text is successfully altered, the attacker could perform a cross-site scripting attack to steal cookie information of weblog readers (including weblog...

Woltlab Burning Board modcp.php Multiple Parameter SQL Injection

The remote version of Burning Board / Burning Board Lite is prone to SQL injection attacks due to its failure to sanitize user-supplied input to the 'x' and 'y' parameters of the 'modcp.php' script before using it in database queries. Provided an attacker has moderator privileges, these flaws may.....

[SA16388] PHlyMail Unspecified Login Bypass Vulnerability

Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ TITLE: PHlyMail Unspecified Login Bypass Vulnerability SECUNIA ADVISORY ID: SA16388 VERIFY ADVISORY:...

PHP Lite Calendar Express 2.2 - 'auth.php?cid' SQL Injection

...

PHP Lite Calendar Express 2.2 - login.php?cid SQL Injection

PHP Lite Calendar Express 2.2 - login.php?cid SQL...

PHP Lite Calendar Express 2.2 - 'login.php?cid' SQL Injection

...

PHP Lite Calendar Express 2.2 - auth.php?cid SQL Injection

PHP Lite Calendar Express 2.2 - auth.php?cid SQL...

PHP Lite Calendar Express 2.2 - 'Subscribe.php?cid' SQL Injection

...

PHP Lite Calendar Express 2.2 - Subscribe.php?cid SQL Injection

PHP Lite Calendar Express 2.2 - Subscribe.php?cid SQL...

quickDoS.txt

...

Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow vulnerabilities)

Details: Input to the user commands is not properly checked and/or filtered. Issuing a long argument to the user (about 1024 caracteres) commands will cause the corresponding process to die without any error message. this vulnerabilities exist in both the professionnal version 3.0 and lite version....

Quick 'n EasY 3.0 FTP Server - Remote Denial of Service

...

Quick n EasY 3.0 FTP Server - Remote Denial of Service

Quick n EasY 3.0 FTP Server - Remote Denial of...