CVE-2008-5302

CVE-2008-5302 affects Perl 5.8.8 and 5.10.0 via the rmtree function in File::Path (lib/File/Path.pm), with a race condition that could let local users create arbitrary setuid binaries through a symlink attack. Affected versions are noted as 1.08 and 2.07; this is described as a regression relativ...

CVE-2008-4494

CVE-2008-4494 is a SQL injection vulnerability affecting TorrentTrader Classic 1.08, 1.04, and earlier, in the completed-advance.php script. The flaw allows remote attackers to execute arbitrary SQL commands by supplying input in the id parameter. The issue originates from improper handling of th...

linkspider-rfi.txt

============================================================= Linkspider v.1.08 Remote File Include Vulnerability ============================================================== App Name : Linkspider v.1.08 HomePage : http://www.phoenix.frihost.net/linkspider/readme.php Vulnerability Discovered by...

Sql injection

Multiple SQL injection vulnerabilities in TorrentTrader 1.08 Classic allow remote attackers to execute arbitrary SQL commands via the 1 email or 2 wantusername parameter to account-signup.php, or the 3 receiver parameter to account-inbox.php in a msg action...

CVE-2008-2428

TorrentTrader 1.08 Classic is affected by multiple SQL injection vulnerabilities in the PHP/MySQL-based TorrentTrader platform. Specifically, unsanitized input in account-signup.php (parameters email and wantusername) and in account-inbox.php (parameter receiver when msg is set) allows remote SQL...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerabilities in account-inbox.php in TorrentTrader Classic 1.08 allow remote attackers to perform certain actions as other users, as demonstrated by sending messages...

CVE-2008-1172

Cross-site request forgery CSRF vulnerabilities in account-inbox.php in TorrentTrader Classic 1.08 allow remote attackers to perform certain actions as other users, as demonstrated by sending messages...

CVE-2008-1173

Cross-site scripting XSS vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2008-1172

CVE-2008-1172 describes a Cross-site request forgery (CSRF) vulnerability in the file account-inbox.php of TorrentTrader Classic 1.08. The issue allows remote attackers to perform certain actions as other users, demonstrated by sending messages. This vulnerability arises in the context of the aff...

CVE-2008-1173

Cross-site scripting XSS vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

DeluxeBB CP.PHP安全绕过漏洞

DeluxeBB是一款基于PHP的WEB应用程序。 DeluxeBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞更改管理员信息。 问题是由于'cp.php'脚本对用户提交的WEB参数缺少过滤，当更新自身的档案时，DeluxeBB执行如下有问题代码： $db-unbufferedquery"UPDATE ".$prefix."users SET email='$xemail', msn='$xmsn', icq='$xicq', ... WHERE username='$membercookie'"; 因此可更改cookie "membercookie"，如更改远程用户的EMAI...

CVE-2007-5940

feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file...

CVE-2007-5940

feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file...

CVE-2007-4484

CVE-2007-4484 describes a PHP remote file inclusion vulnerability in My_REFERER 1.08, specifically in login.php where an attacker can cause arbitrary PHP code execution by supplying a URL in the value parameter. The public description confirms the vulnerable component (login.php) and the vulnerab...

Butterfly online vistors counter 1.08 RFI

App Name : Butterfly online vistors counter v.1.08 HomePage : http://www.phoenix.frihost.net/butterfly/readme.php Vuln type : Remote File Include RFI Vulnerability Discovered by : iNs Vuln Code: visitor.php includeonce $SERVER"DOCUMENTROOT" . "/butterfly/custom.php"; // include settings POC:...

My_REFERER v.1.08 Remote File Include

App Name : MyREFERER v.1.08 HomePage : http://www.phoenix.frihost.net/referer/readme.php Vuln type : Remote File Include RFI Vulnerability Discovered by : iNs Vuln Code: login.php include"$value"; POC: htttp://site.com/path/login.php?value=SHELL.txt?? iNs @ uNkn0wn.eu Gr33tz t0: uNkn0wn.eu - iD -...

CVE-2006-4080

DeluxeBB 1.08, and possibly earlier, uses cookies that include the MD5 hash of a password, which allows remote attackers to gain privileges by sniffing or cross-site scripting XSS and conduct password guessing attacks...

CVE-2006-4080

Summary: CVE-2006-4080 affects DeluxeBB 1.08 (and possibly earlier). The issue arises from cookies that contain the MD5 hash of a password, enabling remote attackers to gain privileges via credential sniffing or cross-site scripting (XSS) and potentially conduct password guessing attacks. The pro...

CVE-2006-4078

pm.php aka the PM system in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter...

CVE-2006-4078

The CVE-2006-4078 entry concerns DeluxeBB 1.08 (and possibly earlier) where pm.php (the PM system) allows remote attackers to bypass authentication by supplying an arbitrary username in the membercookie cookie parameter. This is a logic/authorization flaw in the PM component that enables access w...