CVE-2007-0764

CVE-2007-0764 concerns an unrestricted file upload in F3Site 2.1 and earlier . The vulnerability allows a remote authenticated administrator to upload and execute arbitrary PHP scripts by abusing a GIF86 header in a file passed via the uplf parameter , with the file later retrievable through a re...

CVE-2007-0763

CVE-2007-0763 is an XSS vulnerability in the news comment functionality of F3Site (versions 2.1 and earlier), exploitable via the Autor field to inject arbitrary script/HTML. The affected component is the news comments input processing; root cause is improper input handling leading to script exec...

F3Site 2.1 - Remote Code Execution

? // //Kacper & str0ke Settings $exploitname = "F3Site = 2.1 Remote Code Execution Exploit"; $scriptname = "F3Site 2.1"; $scriptsite = "http://dhost.info/compmaster/"; $dork = '"Powered by F3Site"'; //to work exploit you need admin session, and cookies prefix // print ' ::::::::: :::::::::: ::: :...

Remote file inclusion

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the myroot parameter...

CVE-2007-0498

MySpeach 2.1 beta (and possibly earlier) is affected by CVE-2007-0498 via up.php, allowing remote PHP code execution through a URL parameter my[root]. This is a PHP remote file inclusion vulnerability with a base score of 7.5 (HIGH) and network attack vector, per NVD, and the documents do not pro...

MySpeach 2.1b - up.php Remote File Inclusion

MySpeach 2.1b - up.php Remote File Inclusion ------------------------------------------------------------------------------------------------------------------------ Script:MySpeach Affected Version:beta2.1 and maybe older Downlaoad:http://www.graphiks.net/scripts/chat/myspeach-2.1beta.zip...

Cross site scripting

Cross-site scripting XSS vulnerability in liens.php3 in liensdynamiques 2.1 allows remote attackers to inject arbitrary web script or HTML by using the ajouter=1 query string and the add menu...

Format string

Multiple format string vulnerabilities in 1 invitedToRoom: and 2 invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in the channel name of an INVITE request, relate...

Authentication flaw

1 admin/adminlien.php3 and 2 admin/modif.php3 in liensdynamiques 2.1 do not require authentication, which allows remote attackers to perform unauthorized administrative actions using a direct request...

CVE-2007-0344

CVE-2007-0344 affects Colloquy 2.1 and earlier, with multiple format-string vulnerabilities in the internal methods _invitedToRoom and _invitedToDirectChat. The format specifiers in the channel name of an INVITE request can trigger denial of service (application crash) and potentially arbitrary c...

CVE-2007-0344

Multiple format string vulnerabilities in 1 invitedToRoom: and 2 invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in the channel name of an INVITE request, relate...

CVE-2007-0332

CVE-2007-0332 affects the web application component in liens_dynamiques 2.1, where two admin endpoints (admin/adminlien.php3 and admin/modif.php3) do not require authentication. This allows remote attackers to perform unauthorized administrative actions by crafting a direct request. The public re...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/adminmenu.php in FdWeB Espace Membre 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2007-0301

CVE-2007-0301 describes a PHP remote file inclusion vulnerability in FdWeB Espace Membre 2.1 and earlier. The flaw resides in _admin/admin_menu.php, where an attacker can cause arbitrary PHP code execution by supplying a URL in the path parameter. Affected software is the FdWeB Espace Membre 2.1 ...

RHEL 2.1 : kernel (RHSA-2007:0013)

Updated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 32 bit architectures This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team. The Linux kernel handles the...

Liens_Dynamiques 2.1 - Multiple Cross-Site Scripting Vulnerabilities

LiensDynamiques 2.1 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/22070/info The 'liensdynamiques' program is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6926

CVE-2006-6926 describes a buffer overflow in eXtremail 2.1. The primary description explicitly states unknown impact and attack vectors, with details coming from third-party information (VulnDisco Pack). Connected sources corroborate a stack/buffer overflow scenario in eXtremail 2.1.x (and earlie...

Sql injection

SQL injection vulnerability in admincheckuser.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the username field txtUserName parameter and possibly other parameters. NOTE: some details were obtained from third party information...

CVE-2007-0196

CVE-2007-0196: SQL injection in admin_check_user.asp of Motionborg Web Real Estate 2.1 and earlier allows remote command execution via the username field (txtUserName) and possibly other parameters. Affects the vulnerable web app with network access; CVSS v2 base score 7.5 (HIGH). Impact: partial...