Remote file inclusion

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...

CVE-2006-2877

CVE-2006-2877 describes a PHP remote file inclusion in Bookmark4U 2.0.0 and earlier. An attacker can cause the application to include arbitrary PHP files via the include_prefix parameter in one of four files: inc/dbase.php, inc/config.php, inc/common.php, or inc/function.php. The advisory notes t...

CVE-2006-1634

CVE-2006-1634 corresponds to a cross-site scripting (XSS) vulnerability in LucidCMS 2.0.0 RC4, exploitable via the command parameter in index.php. The XSS could allow remote attackers to inject arbitrary script/HTML. Affected product is LucidCMS 2.0.0 RC4; root cause is improper handling of user-...

WordPress2.0.0-autorswebsite.txt

original advisory ——————-Summary—————- Software: WordPress Sowtware’s Web Site: http://www.wordpress.org Versions: 2.0.0 Class: Remote Status: Unpatched Exploit: Available Solution: Available Discovered by: imei addmimistrator Risk Level: Low —————–Description————— There is some security bug in...

[myimei]WordPress2.0.0~autorswebsite~XSS attack

original advisory http://myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.htmlmore-14 ——————-Summary—————- Software: WordPress Sowtware’s Web Site: http://www.wordpress.org Versions: 2.0.0 Class: Remote Status: Unpatched Exploit: Available Solution: Available Discovered by:...

WordPress Core 2.0 - Comment Post HTML Injection

source: https://www.securityfocus.com/bid/16656/info WordPress is prone to an HTML-injection vulnerability. Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker...

CVE-2006-0084

Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $SERVERHTTPUSERAGENT variable User-Agent header...

CVE-2006-0084

Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $SERVERHTTPUSERAGENT variable User-Agent header...

ICECast HTTP basic authorization DoS

The remote server runs ICECast 2.0.0, an open source streaming audio server. This version is affected by a remote denial of service. An remote attacker could send specially crafted URL, with a long string passed in an Authorization header that will result in a loss of availability for the service...

ICECast < 2.0.1 HTTP Basic Authorization DoS Vulnerability

ICECast is prone to a remote denial of service DoS vulnerability. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2005-0607

CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to 1 information.php, 2 language.php, 3 listdocs.php, 4 popularprod.php, 5 sale.php, 6 subfooter.inc.php, 7 subheader.inc.php, 8 catnavi.php, or 9 checksum.php, which...

CVE-2004-1578

The CVE-2004-1578 entry concerns Invision Power Board 2.0.0 with a cross-site scripting (XSS) vulnerability in index.php that allows an attacker to inject arbitrary web script or HTML via the Referer header in HTTP requests. Documented impact from sources like NVD and CVE lists is that remote att...

Invision Power Board v2.0.0 - 2.0.2 Sql Injection Exploit

Exploit for unknown platform in category web applications ========================================================= Invision Power Board v2.0.0 - 2.0.2 Sql Injection Exploit ========================================================= !/usr/bin/perl use IO::Socket;...

Invision Power Board v2.0.0 - 2.0.2 Sql Injection Exploit

No description provided by source. !/usr/bin/perl use IO::Socket;...

[Full-Disclosure] Icecast 2.0.0 preauth overflow

There exists a remotely exploitable heap overflow in Icecast 2.0.0. The bug exists in the handling of base64 Authorization request. This bug was found in about 40 seconds during a HTTP audit of the web component of Icecast with the fuzzer SMUDGE http://felinemenace.org/nd/SMUDGE/ People complaine...

rush12.txt

RusH security team | http://www.rsteam.ru o----------------------------= Advisory 12 =----------------------------o oxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo o--------------------------------------------------------------------------o | Product: phpWebFileManage...

phpWebFileManager v2.0.0 - Directory traversal

RusH security team | http://www.rsteam.ru o----------------------------= Advisory 12 =----------------------------o oxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo o--------------------------------------------------------------------------o | Product: phpWebFileManage...

keyfocus.txt

KeyFocus Web server is a Win32 HTTP server with web administration, a variety of logging formats, such as NCSA and W3C, CGI, compression, memory caching of static documents, directory indexing, pre-defined MIME settings, internal authentication with support for multiple realms, and a variety of U...

CVE-2002-0433

Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "" wildcard or asterisk character...

CVE-2002-0433

The CVE-2002-0433 entry concerns Pi3Web 2.0.0 where remote attackers can view restricted files by issuing an HTTP request containing a wildcard character ("*"). This is an unauthorized disclosure vulnerability via crafted requests, as described in NVD and CVE records. Connected documents confirm ...