541 matches found
CVE-2009-2616
The CVE-2009-2616 vulnerability concerns DataCheck Solutions SitePal 1.x, where a flaw in z_admin_login.asp enables remote execution of arbitrary SQL commands via unspecified vectors. The available sources confirm an SQL injection in the login component but do not specify affected versions beyond...
CVE-2009-2614
SQL injection vulnerability in zadminlogin.asp in DataCheck Solutions LinkPal 1.x allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2009-2546
Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...
Directory traversal
Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...
Onepound Shop 1.x SQL Injection
\ / /| | | | \ | | | | | | \ | | | | | | \ \ | | \ | | | | \ | | \ \ | | | \ | |/ / |/ http://root-the.net + onepund shop 1.x products.php SQL Injection Vulnerability + Vendor : onepound.cn + Exploit : Affix + Greetz : Mad-Hatter, Atomiku, RTN, Terogen, SCD, Boxhead, str0ke, tekto, SonicX,...
Matterdaddy Market 1.x - 'index.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/35856/info Matterdaddy Market is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...
[SECURITY] Fedora 10 Update: freetype1-1.4-0.8.pre.fc10
The FreeType engine is a free and portable TrueType font rendering engine, developed to provide TrueType support for a variety of platforms and environments. FreeType is a library which can open and manages font files as well as efficiently load, hint and render individual glyphs. FreeType is no ...
CVE-2009-1738
Cross-site scripting XSS vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."...
CVE-2009-0761
CVE-2009-0761 describes a cross-site scripting (XSS) vulnerability in the age-old Team Board 1.x product, specifically in the online.asp component. The issue allows remote attackers to inject arbitrary web script or HTML via the lookname parameter. According to the sources, the CVSS base score is...
Grestul 1.x Auth Bypass by Cookie SQL Injection Vulnerability
Exploit for unknown platform in category web applications ============================================================= Grestul 1.x Auth Bypass by Cookie SQL Injection Vulnerability ============================================================= Grestul Sql Injection By Cookie bypass Autore: x0r...
Grestul 1.x - Cookie Authentication Bypass
Grestul Sql Injection By Cookie bypass Autore: x0r Email: [email protected] Site: http://w00tz0ne.org Let's Go! \admin\login.php : $username = SafeAddSlashes$POST'username'; $passcode = SafeAddSlashesmd5$POST'passcode'; $time = time; $check = SafeAddSlashes$POST'setcookie'; $query = "SELECT...
Grestul 1.x - Cookie Authentication Bypass
Grestul 1.x - Cookie Authentication Bypass Grestul Sql Injection By Cookie bypass Autore: x0r Email: [email protected] Site: http://w00tz0ne.org Let's Go! \admin\login.php : $username = SafeAddSlashes$POST'username'; $passcode = SafeAddSlashesmd5$POST'passcode'; $time = time; $check =...
Grestul 1.x Auth Bypass by Cookie SQL Injection Vulnerability
No description provided by source. Grestul Sql Injection By Cookie bypass Autore: x0r Email: [email protected] Site: http://w00tz0ne.org Let's Go! \admin\login.php : $username = SafeAddSlashes$POST'username'; $passcode = SafeAddSlashesmd5$POST'passcode'; $time = time; $check =...
CVE-2009-0458
Multiple SQL injection vulnerabilities in admin/loginsubmit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via 1 the uid parameter aka Username field or 2 the pwd parameter aka Password field. NOTE: some of these details are obtained from third party...
CVE-2009-0461
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie...
CVE-2009-0460
Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie...
Sql injection
Multiple SQL injection vulnerabilities in admin/loginsubmit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via 1 the uid parameter aka Username field or 2 the pwd parameter aka Password field. NOTE: some of these details are obtained from third party...
CVE-2009-0461
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie...
CVE-2009-0460
CVE-2009-0460 affects Whole Hog Ware Support 1.x. The vulnerability allows remote attackers to bypass authentication and obtain administrative access by manipulating an integer value in the adminid cookie. The root cause is improper validation of the adminid cookie, enabling privilege escalation ...