phpBB viewtopic.php Arbitrary Code Execution

This module exploits two arbitrary PHP code execution flaws in the phpBB forum system. The problem is that the 'highlight' parameter in the 'viewtopic.php' script is not verified properly and will allow an attacker to inject arbitrary code via pregreplace. This vulnerability was introduced in...

Apache mod_jk2 < 2.0.4 Multiple Overflows

Binary data 4376.prm...

Sql injection

SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via 1 the useremail parameter and possibly 2 username parameter in a Members action...

SmallNuke 2.0.4 Pass Recovery Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; $mw = new MainWindowtitle = "UnderWHAT?!" ; $mw-geometry '420x365' ; $mw-resizable0,0; $mw-Label-text = '', -font = 'Verdana 8',-foreground='red'-pack; $mw-Label-text = 'Smallnuke...

SmallNuke 2.0.4 - Pass Recovery SQL Injection

SmallNuke 2.0.4 - Pass Recovery SQL Injection !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; $mw = new MainWindowtitle = "UnderWHAT?!" ; $mw-geometry '420x365' ; $mw-resizable0,0; $mw-Label-text = '', -font = 'Verdana 8',-foreground='red'-pack; $mw-Label-text =...

SmallNuke 2.0.4 Pass Recovery Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================== SmallNuke 2.0.4 Pass Recovery Remote SQL Injection Exploit ========================================================== !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox;...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 room parameter to sources/frame.php, the 2 themec parameter to help/index.php, or the 3 INSTALLX7CHATVERSION parameter to...

x7-xss.txt

X7 Chat 2.0.4 XSS ---------- Author : ShAy6oOoN ---------- Group : PitBull Crew ---------- Script : X7 Chat 2.0.4 ---------- Download : http://www.x7chat.com/releases/v2/x7chat205.zip ---------- Vuln Type: XSS ---------- Registerglobals: ON -----------------...

JVN#63602912 dotProject cross-site scripting vulnerability

This vulnerability is different from JVN97636431. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, session hijacking could be conducted. Solution Update the Software The developer has released dotProject version 2...

Linker 2.0.4 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24277/info Codelib Linker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user ...

Linker 2.0.4 - index.php Cross-Site Scripting

Linker 2.0.4 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24277/info Codelib Linker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary scrip...

Apple Safari 2.0.4 - Cross-Domain Browser Location Information Disclosure

source: https://www.securityfocus.com/bid/24121/info Apple Safari is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain JavaScript restrictions. Exploiting this issue may allow attackers to access locations that a user visits, even if it's in a...

OTRS 2.0.4 - index.pl Cross-Site Scripting

OTRS 2.0.4 - index.pl Cross-Site Scripting source: https://www.securityfocus.com/bid/23862/info OTRS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

CVE-2007-0007

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the 1 gnucash.trace, 2 qof.trace, and 3 qof.trace.PID temporary files...

[SA23465] tDiary Unspecified Ruby Code Execution Vulnerability

TITLE: tDiary Unspecified Ruby Code Execution Vulnerability SECUNIA ADVISORY ID: SA23465 VERIFY ADVISORY: http://secunia.com/advisories/23465/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: tDiary 2.x http://secunia.com/product/5496/ DESCRIPTION: Takagi Hiroshi has...

CVE-2006-4234

PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter...

dotProject 2.0.4 - baseDir Remote File Inclusion

dotProject 2.0.4 - baseDir Remote File Inclusion / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - dotProject = 2.0.4 baseDir Remote File Include Vulnerabilities + - Script name: dotProject v. 2.0.4 - Script site: http://www.dotproject.net/ + + + - Find by: Kacper a.k.a Rahim + - Contact:...

CVE-2006-4028

Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related ...

CVE-2006-4028

The WordPress CVE-2006-4028 entry concerns WordPress up to version 2.0.4 with multiple vulnerabilities described in connected advisories. Gentoo/GLSA and Tenable entries indicate a privilege-escalation issue tied to WordPress plugins, stemming from a flaw in capability checking that could allow a...

CVE-2006-3851

The CVE-2006-3851 entry covers an SQL injection in upgradev1.php for X7 Chat 2.0.4 and earlier, exploitable via the old_prefix parameter to execute arbitrary SQL commands remotely. Affected product: X7 Chat (PHP-based web chat). Root cause: improper sanitization of the old_prefix input before use...