mcGallery 1.1 - 'detail.php?lang' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28587/info mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

mcGallery 1.1 - resize.php?lang Cross-Site Scripting

mcGallery 1.1 - resize.php?lang Cross-Site Scripting source: https://www.securityfocus.com/bid/28587/info mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary...

mcGallery 1.1 - 'admin.php?lang' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28587/info mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

CVE-2008-1636

CVE-2008-1636 describes a cross-site scripting (XSS) vulnerability in the JV2 Quick Gallery 1.1 product, specifically in index.php via the f parameter. The connected NVD entry confirms the vulnerability allows remote attackers to inject arbitrary script/HTML through the f parameter, indicating in...

CVE-2003-1554

CVE-2003-1554 corresponds to a cross-site scripting (XSS) vulnerability in ScozNet ScozBook 1.1 BETA. The flaw resides in scozbook/add.php, allowing an attacker to inject arbitrary script/HTML via the 6 parameters: username, useremail, aim, msn, sitename, and siteaddy. The NASL/OSS Nessus entry a...

CVE-2008-1464

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2008-1464

Gallarific Free Edition 1.1 is affected by multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL commands via input fields in distinct endpoints: the query parameter to search.php; gusername and gpassword to login.php; and username/password to gadmin/i...

Joomla Components custompages 1.1 Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Joomla Components custompages 1.1 Remote File Inclusion Vulnerability ===================================================================== @ JOOmla Component custompage...

CVE-2008-1370

The provided connected sources confirm CVE-2008-1370 is a remote file inclusion vulnerability in Yap Blog’s index.php. Affected software: Yap Blog 1.1 (and up to 1.1.1 per OpenVAS entry). Root cause: insufficient sanitization/validation of user-supplied input, allowing a crafted URL in the page p...

yapblog-rfi.txt

Description: Yap Blog 1.1 Remote File Include RFI Script Name: Yap Blog 1.1 Author : THEMILLER contact : themilleratlinuxmail.org Download URL : http://wildmary.net-sauvage.com/share/yap1.1.tar.gz Bug Type: Remote File Inclusion Bug In: index.php Vulnerable Code: if isset$GET'page' include...

PT-2008-2812 · Kutubisitte · Kutub-I Sitte

Name of the Vulnerable Software and Affected Versions: Kutub-i Sitte KutubiSitte version 1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the kid parameter in a hadisgoster action to modules.php. Recommendations: For Kutub-i Sitt...

CVE-2003-1552

The CVE-2003-1552 entry affects Uploader 1.1, via an unrestricted file upload vulnerability in uploader.php. A remote attacker can upload a file with an executable extension and then access it in the uploads/ directory to trigger arbitrary code execution. The vulnerability is mapped with a Networ...

Yap Blog 1.1 - index.php Remote File Inclusion

Yap Blog 1.1 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/28120/info Yap Blog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and...

Yap Blog 1.1 - 'index.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/28120/info Yap Blog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also...

Null pointer dereference

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes sendinterface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface...

DEBIAN-CVE-2008-0984

The MP4 demuxer mp4.c for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file...

CVE-2008-0832

SQL injection vulnerability in index.php in the Kemas Antonius comquran 1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the surano parameter in a viewayat action...

Mambo Component Ricette 1.0 - SQL Injection

Mambo Component Ricette 1.0 - SQL Injection joomla SQL Injectioncomricette AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAÄ°L : [email protected] DORK 1 : allinurl: comricette DORK 2 : allinurl: "comricette"id EXPLOIT :...

Mambo Component Quran 1.1 - surano SQL Injection

Mambo Component Quran 1.1 - surano SQL Injection +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...

Cross site scripting

Cross-site scripting XSS vulnerability in templates/default/admincp/attachmentsheader.php in DeluxeBB 1.1 allows remote attackers to inject arbitrary web script or HTML via the langlistofmatches parameter...