CVE-2007-0692

DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages...

CVE-2007-0693

CVE-2007-0693 corresponds to an SQL injection in DGNews 2.1, impacting the news.php component (newslist action) via the catid parameter and with note of possible cross-site scripting. The provided documents do not list a vendor patch or fixed version. CVSS-like metrics exist in the initial record...

CVE-2007-0692

DGNews 2.1 is affected by a path-disclosure vulnerability (CVE-2007-0692) in news.php (fullnews) when an invalid newsid parameter is supplied, potentially revealing server paths via error messages. The issue is triggered by the fullnews/news.php flow and related error output, with the advisory no...

CVE-2007-0694

DGNews 2.1 is affected by a cross-site scripting (XSS) vulnerability in footer.php that allows remote attackers to inject arbitrary web script or HTML via the copyright parameter. The issue arises when user-controlled content is reflected back in the page, enabling script execution in the victim’...

DGNews version 2.1 Path Disclosure Vulnerability

netVigilance Security Advisory 21 DGNews version 2.1 Path Disclosure Vulnerability Description: DGNews is small and simple but powered news publishing. Easy installation, no programing required. But you can still change whatever you want for advanced users. Features: add unlimited categories,...

Re: DGNews version 2.1 SQL Injection Vulnerability

hi there there's also another sql injection on this script: news.php?go=fullnews&newsid=-9+union+select+1,2,loadfilechar47,101,116,99,47,112,97,115,115,119,100,4,5,6,720from20newscomment/ //result: "This news has 1 comments. Please read, or post one by click here. 5 by:...

DGNews 1.5.12.1 - news.php SQL Injection

DGNews 1.5.12.1 - news.php SQL Injection source: https://www.securityfocus.com/bid/24201/info DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow an attacker to...

DGNews 2.1 - footer.php Cross-Site Scripting

DGNews 2.1 - footer.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24200/info DGNews is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affect...

DGNews 2.1 - NewsID SQL Injection

DGNews 2.1 - NewsID SQL Injection source: https://www.securityfocus.com/bid/24212/info DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploits could allow an attacker to compromis...

CVE-2007-2685

Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the 1 view or 2 login parameter...

CVE-2007-2685

Jetbox CMS 2.1 has SQL injection vulnerabilities in index.php via the view and login parameters, allowing remote attackers to execute arbitrary SQL commands. Root cause: improper handling of input in Jetbox CMS 2.1 leads to injectable SQL. Exploitation is described as remote with no authenticatio...

CVE-2007-2685

Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the 1 view or 2 login parameter...

CVE-2007-2684

Jetbox CMS 2.1 is affected by multiple information-disclosure vectors. The vulnerability arises from (1) direct requests to main_page.php, open_tree.php, and outputs.php, (2) a malformed view parameter to index.php enabling SQL-injection-like manipulation, and (3) the id[] parameter pass-through ...

CVE-2007-2731

CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail headers via LF %0A sequences in the subject parameter, a related issue to CVE-2007-1898...

Jetbox CMS 2.1 Email - 'FormMail.php' Input Validation

source: https://www.securityfocus.com/bid/23989/info Jetbox CMS is prone to an input-validation vulnerabilitiy because it fails to adequately sanitize user-supplied input. Attackers can exploit this issue to send spam email in the context of the application. Jetbox 2.1 is vulnerable; other versio...

CVE-2007-2606

Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by 1 config\ConfigFile.cpp or 2 msgs\checkmsgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then t...

Buffer overflow

Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by 1 config\ConfigFile.cpp or 2 msgs\checkmsgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then t...

CVE-2007-2606

Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by 1 config\ConfigFile.cpp or 2 msgs\checkmsgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then t...

CVE-2007-2606

Firebird 2.1 contains multiple buffer overflows in input handling (config\ConfigFile.cpp and msgs\check_msgs.epp) that can lead to memory corruption and unspecified impact. Affected product is Firebird; root cause is buffer overflows in the two code paths cited in CVE-2007-2606. Public details ac...

CVE-2007-2606

Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by 1 config\ConfigFile.cpp or 2 msgs\checkmsgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then t...