CVE-2006-0722: Undefined Security Weakness

settings.php in Reamday Enterprises Magic Downloads 1.1.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are no...

Hummingbird Collaboration - Crafted URL File Property Obscuration Download

Hummingbird Collaboration - Crafted URL File Property Obscuration Download source: https://www.securityfocus.com/bid/16195/info Hummingbird Enterprise Collaboration is prone to multiple vulnerabilities. The following specific issues were identified: The application reportedly allows remote...

CVE-2005-4637

Multiple cross-site scripting XSS vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 nav parameter in the downloads module, 2 Full Name and 3 Email fields in the core module, 4 Full Name, 5 Email, and 6...

CVE-2005-4638: Undefined Security Weakness

index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to obtain the full path via 1 a and 2 newsid parameters in the news module, 3 downloaditemid parameter in the downloads module, and 4 kbarticleid parameter in the knowledgebase module...

CVE-2005-4637: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 nav parameter in the downloads module, 2 Full Name and 3 Email fields in the core module, 4 Full Name, 5 Email, and 6...

CVE-2005-4400: Undefined Security Weakness

Cross-site scripting XSS vulnerability in downloads/portalent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 77strutsaction, 2 ppmode, and 3 ppstate parameters...

1-2-3 music store "AlbumID" Sql injection.

1-2-3 music store "AlbumID" Sql injection. Vuln. dicovered by : r0t Date 23 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/1-2-3-music-store-albumid-sql.html Vendor:http://easybe.com/ affected version: 1.0 and prior Product Description: Description: 1-2-3 Music Store - the music...

CVE-2005-3681

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

CVE-2005-3681

CVE-2005-3681 describes a SQL injection vulnerability in the XOOPS WF-Downloads module 2.05. The flaw affects the file viewcat.php where the list parameter can be exploited to execute arbitrary SQL commands. Based on the provided documents, the vulnerability is exploitable remotely (network vecto...

CVE-2005-3681

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

CVE-2005-3681: Undefined Security Weakness

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

[[email protected]: Macromedia Security Bulletins]

Macromedia Security Bulletins: - Contribute Publishing Server - Flash Communication Server - Breeze Communication Server and Breeze Live Server MPSB05-08 Contribute Publishing Server Password Encryption Summary: Macromedia Contribute Publishing Server CPS 1.11 includes a security update that...

XOOPS 2.2.3 Final arbitrary local inclusion / XOOPS WF-Downloads module v 2.05 SQL Injection

11.04 12/11/2005 1XOOPS 2.2.3 Final arbitrary local inclusion 2XOOPS WF-Downloads module v 2.05 SQL Injection / Administrative credentials disclousre / Remote commands execution software: site: http://www.xoops.org/ description: "XOOPS is an extensible, OO Object Oriented, easy to use dynamic web...

CVE-2005-3304

Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via 1 the username parameter in the Your Account page, 2 the url parameter in the Downloads module, and 3 the description parameter in the WebLinks module...

PhpNuke 7.8 with all security fixes/patches "Your_Account", "Downloads", "Web Links" SQL Injection / Remote commans execution

PHPNuke 7.8 with all security fixes/patches "Downloads", "WebLinks" & "YourAccount" SQL INjection - remote commands execution poc exploit there are a lot of unsanitized vars in every module, as I can see, so if magicquotesgpc is Off - SQL INJECTION 1 you can go to "Your Account" and submit a...

PHP-Nuke 7.8 - SQL Injection / Remote Command Execution

?php 20.05 23/10/2005 ---phpnuke78xpl.php PHPNuke 7.8 with all security fixes/patches "Downloads","WebLinks" & "YourAccount" modules SQL Injection / remote commands execution exploit yet not tested 7.9, but OK... by rgod site: http://rgod.altervista.org make these changes in php.ini if you have...

CVE-2005-2885

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2885: Undefined Security Weakness

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2690

SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php...

CVE-2005-2690: Undefined Security Weakness

SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php...