HRG007.txt

HRG - Hackerlounge Research Group Release: HRG007 Monday 03/01/05 427BB The author can't be held responsible for any damage done by a reader. You have your own resonsibility Please use this document like it's meant to. Vulnerable: 427BB Any Version --- General Information: 427BB Is a simple board...

CVE-2005-0629

Multiple cross-site scripting XSS vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 Avatar parameters...

427BB profile.php XSS vulnerability.

HRG - Hackerlounge Research Group Release: HRG007 Monday 03/01/05 427BB The author can't be held responsible for any damage done by a reader. You have your own resonsibility Please use this document like it's meant to. Vulnerable: 427BB Any Version --- General Information: 427BB Is a simple board...

CVE-2005-0570

PunBB 1.2.1 contains a vulnerability in profile.php that allows remote attackers to cause a denial of service (account lockout) by setting a user’s password to NULL. This is the concrete vulnerability described in CVE-2005-0570 across sources (NVD/NIST and CVE list). The connected documents also ...

CVE-2005-0570: Undefined Security Weakness

profile.php in PunBB 1.2.1 allows remote attackers to cause a denial of service account lockout by setting the user's password to NULL...

CVE-2005-0569: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the 1 language parameter to register.php, 2 change email feature in profile.php, 3 posts or 4 topics parameter to moderate.php...

Multiple vulns in punBB

================================================= SQL Injections in punbb-1.2.1 register.php ================================================= Description ----------- A remote attacker can cause register.php to execute arbitrary SQL statements by supplying malicous values to the language or email...

CVE-2004-1567

Silent Storm Portal (2.1/2.2) exposes a privilege escalation in profile.php: setting the mail parameter to 1 (the admin value) allows remote attackers to gain administrator privileges. Vulnerable parameter handling is the root cause; the CVE entry documents this as an admin-privilege bypass via a...

CVE-2004-1567: Undefined Security Weakness

profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the value for an administrator...

WordPress 1.2.x XSS Advisory

Module: wp-admin/profile.php Fields: First Name, Last Name. Нет проверки на знаки & Возможно внедрение java-скрипта. Патч: http://adz.void.ru/file.php?op=get&id=6 Описание: http://adz.void.ru/index.php?p=5 ------------ Легкой Смерти!...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-1567

profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the value for an administrator...

PunBB profile.php XSS

According to its banner, the version of PunBB installed on the remote host fails to properly sanitize user input to the script 'profile.php'. With a specially crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser, resulting in a loss of integrity, theft of...

CVE-2004-0729: Undefined Security Weakness

PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid 1 categoryrows parameter to index.php, 2 faq parameter to faq.php, or 3 ranksrow parameter to profile.php, which reveal the full path in an error message...

phpBB profile.php Cross Site Scripting Vulnerability

Advisory Name : phpBB profile.php Cross Site Scripting Vulnerability Release Date : Mar 21,2004 Application : phpBB Version : phpBB 2.0.6d or others? Platform : PHP Vendor URL : http://www.phpbb.com/ Author : Cheng Peng Suapplesoupatmsn.com Proof of Conecpt: This vuln is in profile.php,when you...

Phorum 5.0.3 Beta && Earlier XSS Issues

Vendor : Phorum URL : http://www.phorum.org Version : Phorum 5.0.3 Beta && Earlier Risk : Cross Site Scripting Description: Phorum is a web based message board written in PHP. Phorum is designed with high-availability and visitor ease of use in mind. Features such as mailing list integration, eas...

Phorum 3.x - login.php HTTP_REFERER Cross-Site Scripting

Phorum 3.x - login.php HTTPREFERER Cross-Site Scripting source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php',...

Phorum 5.0.3 Beta - Cross Site Scripting

Phorum 5.0.3 Beta - Cross Site Scripting Phorum Cross Site Scripting Vendor: Phorum Product: Phorum Version: tag, it will allow for pretty much any thing else, and most of you know it is not hard to execute javascript inside of a tag which is allowed. This same vulnerability also exists in...

Phorum 3.x - profile.php?target Cross-Site Scripting

Phorum 3.x - profile.php?target Cross-Site Scripting source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php',...

Phorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting

source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidde...