2470 matches found
EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability
Exploit for unknown platform in category web applications =================================================================== EQdkp = 1.3.1 Referer Spoof Remote Database Backup Vulnerability =================================================================== Title: EQdkp = 1.3.1 Referer Spoof to...
EQdkp 1.3.1 - Referer Spoof Remote Database Backup
EQdkp 1.3.1 - Referer Spoof Remote Database Backup Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected]...
EQdkp 1.3.1 - 'Referer Spoof' Remote Database Backup
Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] -------------------------------------------------------------------------------------------------------- Background: EQdkp is the largest DKP...
CVE-2003-1312
siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...
httpd cross-site scripting flaw in mod_imap
Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
CVE-2006-4798: Undefined Security Weakness
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history...
Sending multipart/form-data requests from Flash (with arbitrary headers)
Hello lists, In my original "Forging HTTP request headers with Flash" paper http://www.securityfocus.com/archive/1/441014, I mentioned forcing multipart/form-data input format to ensure that Flash's LoadVars isn't used to forge the request. However, there's a work-around for the attacker - using...
CVE-2006-4035
SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...
CVE-2006-4035: Undefined Security Weakness
SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header...
[Full-disclosure] CounterChaos <= 0.48c SQL Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: CounterChaos = 0.48c SQL Injection Vulnerability Release Date: 2006/08/04 Last Modified: 2006/08/03 Author: Tamriel tamriel at gmx dot net Application: CounterChaos = 0.48c Risk: Moderate Vendor Status: not contacted Vendor Site:...
CVE-2006-3328
newticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter "Ticket Description" field that points to a URL that captures referer URLs, possibly due to a cross-site scripting XSS vulnerability or a leak of...
CVE-2006-3328
CVE-2006-3328 affects Hostflow 2.2.1-15. The issue is triggered by an IMG tag in the desc parameter (Ticket Description) that can capture referer URLs, enabling retrieval or replay of authentication credentials via potential XSS or credential leakage in referer headers. NVD lists a base score of ...
CVE-2006-3328: Undefined Security Weakness
newticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter "Ticket Description" field that points to a URL that captures referer URLs, possibly due to a cross-site scripting XSS vulnerability or a leak of...
CVE-2006-3064: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the addhit function in include/function.inc.php in Coppermine Photo Gallery CPG 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the 1 referer and 2 user-agent HTTP headers...
CVE-2006-2795
Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...
CVE-2006-2795: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...