CVE-2005-4379

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the 1 sortmode parameter to a fisheye/listgalleries.php, b messages/messagebox.php, and c users/my.php; the 2 postid parameter to d blogs/viewpost.ph...

[Full-disclosure] [ACSSEC-2005-11-27-0x2] Remote Overflows in Mailenable Enterprise 1.1 / Professional 1.7

Re: See-Security Research and Development "A remote buffer overflow exists in MailEnable Enterprise 1.1 IMAP EXAMINE command, which allows for post authentication code execution. This vulnerability affects Mailenable Enterprise 1.1 without the ME-10009.EXE patch." -- There's a reason why the...

MailEnable Enterprise Edition 1.1 (EXAMINE) Buffer Overflow Exploit

No description provided by source. !/usr/bin/python Remote Mailenable Enterprise 1.1 EXAMINE buffer Overflow Discovered and exploited by [email protected] This vulnerability affects Mailenable Enterprise 1.1 without the ME-10009.EXE patch. Details: SEH gets overwritten at 965 968 in VMWare...

Lighthouse CMS 1.1 - Search Cross-Site Scripting

source: https://www.securityfocus.com/bid/15952/info Lighthouse is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser o...

CVE-2005-4170

SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php...

CVE-2005-4171

The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP...

CVE-2005-4170

An SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands through the uid parameter to viewuser.php. This CVE-2005-4170 (NVD entry) has a base score of 7.5 (HIGH) with NETWORK access, LOW complexity, no authentication, and partial impacts on confiden...

CVE-2005-4171

The CVE reports a remote PHP code execution in eFiction 1.1 when image-upload is allowed. An uploaded file named with a .php extension can start as a GIF (passes image validation) but contains PHP code that gets executed by the web server, enabling arbitrary code execution. The vulnerability stem...

CVE-2005-4167

CVE-2005-4167 affects eFiction 1.0 and 1.1, where the let parameter in titles.php’s viewlist action is not sanitized, enabling stored or reflected XSS by remote attackers to inject arbitrary script/HTML. The vulnerability arises from unsanitized user input used to generate dynamic pages, allowing...

CVE-2005-4159

NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum SMF 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. NOTE: the vendor says that since only one character...

PT-2005-4858 · Simple Machines · Simple Machines Forum

Name of the Vulnerable Software and Affected Versions: Simple Machines Forum SMF versions 1.1 rc1 and earlier Description: A SQL injection issue in Memberlist.php allows remote attackers to potentially execute arbitrary SQL commands via the start parameter. However, the vendor and third parties...

CVE-2005-4055

CVE-2005-4055 affects Cars Portal 1.1 and earlier; the vulnerability is a SQL injection in index.php exploitable via the (1) page and (2) car parameters, allowing remote attackers to execute arbitrary SQL commands. No remediation or patch details are provided in the connected sources here. Resear...

CVE-2005-4055

SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 page and 2 car parameters...

SimpleBBS <= 1.1 Remote Commands Execution Exploit (c code)

No description provided by source. / SimpleBBS = v1.1 remote commands execution in c coded by: unitedasia v.Dec.7.2005 greetz: iloveyouma http://geography.about.com/library/maps/blrasia.htm http://www.lib.utexas.edu/maps/middleeastandasia/asiapol00.jpg $ gcc -o bbs bbs.c Usage ./bbs host /folder/...

CVE-2005-4032

CVE-2005-4032 describes a cross-site scripting (XSS) vulnerability in search.cgi of Easy Search System 1.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML through the q parameter. The available connected documents confirm the existence of the vulnerability and...

Cars Portal 1.1 - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/15747/info Cars Portal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise ...

CVE-2005-4027

CVE-2005-4027 affects SimpleBBS 1.1. The issue is a SQL injection vulnerability reported to allow remote attackers to execute arbitrary SQL commands via unspecified search module parameters. The provided sources list a CVSS2 base score of 7.5 (HIGH) with network attack vector, low complexity, and...

CVE-2005-3937

The CVE-2005-3937 entry concerns a SQL injection vulnerability in Softbiz B2B Trading Marketplace Script 1.1 and earlier. The flaw allows remote attackers to execute arbitrary SQL commands by manipulating the cid parameter in one of four scripts: selloffers.php, buyoffers.php, products.php, or pr...

CVE-2005-3953

Bedeng PSP 1.1 is affected by an SQL injection via user-supplied input to index.php, download.php (parameter cwhere) and baca.php (parameter ckode). Root cause: improper handling of input enables arbitrary SQL execution by remote attackers. Impact: information exposed or modified data; scale/gene...

CVE-2005-3953

SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter to 1 index.php and 2 download.php, or 3 ckode parameter to baca.php...