Sql injection

SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action...

CVE-2010-4897

CVE-2010-4897 is a SQL injection vulnerability affecting BlueCMS 1.6, specifically in comment.php. An attacker could send crafted requests via the X-Forwarded-For HTTP header in a send action to execute arbitrary SQL commands. This is supported by multiple sources (NVD, Red Hat, CVE records). The...

CVE-2010-4882

Cross-site scripting XSS vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter...

CVE-2010-4882

Cross-site scripting XSS vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter...

CVE-2010-4882

Auto CMS 1.6 is affected by a cross-site scripting (XSS) vulnerability in autocms.php, exploitable via the sitetitle parameter. The root cause is insufficient input sanitization of sitetitle, allowing remote attackers to inject arbitrary HTML/JavaScript into the user’s browser. The CVE entry CVE-...

Sql injection

SQL injection vulnerability in ajax/coupon.php in Zuitu 1.6, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a consume action...

CVE-2010-4854

SQL injection vulnerability in ajax/coupon.php in Zuitu 1.6, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a consume action...

CVE-2010-4854

CVE-2010-4854 affects Zuitu 1.6, specifically the Ajax endpoint ajax/coupon.php. The vulnerability arises in the consume action where the id parameter can be exploited to perform SQL injection when magic_quotes_gpc is disabled. This allows remote attackers to potentially execute arbitrary SQL com...

PT-2011-4741 · Unknown · Black-Letterhead

Name of the Vulnerable Software and Affected Versions: Black-LetterHead theme version 1.5 and earlier Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the PATH INFO to index.php. Recommendations: F...

CVE-2011-3484

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service loop and application crash via a malformed packet...

Satellite/Spacewalk: XSS flaw in channels search

Multiple cross-site scripting XSS vulnerabilities in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allow remote attackers to inject arbitrary web script or HTML via vectors related to Search forms...

Satellite/Spacewalk: XSS on the Lost Password page

Cross-site scripting XSS vulnerability in the Lookup Login/Password form in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2009-5093

Directory traversal vulnerability in gastbuch.php in Gästebuch Gastebuch 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the start parameter...

Directory traversal

Directory traversal vulnerability in gastbuch.php in Gästebuch Gastebuch 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the start parameter...

CVE-2009-5093

Directory traversal vulnerability in gastbuch.php in Gästebuch Gastebuch 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the start parameter...

Hardcoded credentials

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

Code injection

Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488...

CVE-2011-2892

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

(mod_dav_svn): File contents disclosure of files configured to be unreadable by those users

The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz shortcircuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to...