Bandersnatch 0.4 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/25094/info Bandersnatch is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include multiple SQL-injections vulnerabilities and an HTML-injection vulnerability. A successful...

Cross site scripting

Cross-site scripting XSS vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs...

CVE-2007-3909

CVE-2007-3909 describes multiple SQL injection vulnerabilities in Bandersnatch 0.4. The affected component is the web application logic handling input parameters, with confirmed vectors including the (1) date and (2) limit parameters to index.php, plus other unspecified vectors. The underlying im...

CVE-2007-3910

Bandersnatch 0.4 is affected by an XSS vulnerability (CVE-2007-3910) where remote attackers can inject arbitrary JavaScript via a Jabber resource name (and possibly other data items) that are stored in conversation logs. Multiple sources in the connected set corroborate the issue and describe the...

CVE-2007-3910

Cross-site scripting XSS vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs...

CVE-2007-3289

PHP remote file inclusion vulnerability in spaw/spawcontrol.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656...

Sql injection

Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog QDBlog 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2007-2305

The CVE-2007-2305 entry concerns multiple SQL injection flaws in the Quick and Dirty Blog (QDBlog) 0.4 (and possibly earlier) within the authenticated path. Specifically, the vulnerability resides in authenticate.php, where the (1) username and (2) password parameters can be manipulated to execut...

CVE-2006-5024

Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner sHTTPScanner before 0.4 have unknown impact and attack vectors...

PT-2006-5765 · Paisterist · Paisterist Simple Http Scanner

Name of the Vulnerable Software and Affected Versions: Paisterist Simple HTTP Scanner sHTTPScanner versions prior to 0.4 Description: The issue involves multiple unspecified vulnerabilities with unknown impact and attack vectors in the Paisterist Simple HTTP Scanner sHTTPScanner. Recommendations:...

SolidState 0.4 - Multiple Remote File Inclusions

::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+ +:+:+ +:+ ++ +++:++ +++:++++: ++ +:+ ++ ++ ++ +...

SolidState <= 0.4 Multiple Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ============================================================== SolidState = 0.4 Multiple Remote File Include Vulnerabilities ============================================================== ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+...

CVE-2006-4048

Netious CMS 0.4 initializes session IDs based on the client IP address, which allows remote attackers to gain access to the administration section when originating from the same IP address as the administrator. NOTE: the provenance of this information is unknown; the details are obtained from thi...

CVE-2006-1639

SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2006-0808

MUTE 0.4 allows remote attackers to cause a denial of service messages not forwarded and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes...

CVE-2006-0808

MUTE 0.4 allows remote attackers to cause a denial of service messages not forwarded and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes...

CVE-2005-4726

MUTE 0.4 uses improper flood protection algorithms, which allows remote attackers to obtain sensitive information privacy leak and search result data by controlling a drop chain neighbor that is near the end of a message chain...

CVE-2005-4726

The CVE-2005-4726 entry concerns MUTE 0.4, which uses improper flood protection algorithms. The Red Hat entry reiterates that remote attackers can obtain sensitive information (privacy leak and search result data) by manipulating a drop chain neighbor near the end of a message chain. The document...

Remote file inclusion

PHP remote file include vulnerability in inc/backendsettings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALSpath parameter...

CVE-2006-0565

PHP remote file include vulnerability in inc/backendsettings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALSpath parameter...