Invision Power Board 'name'参数SQL注入漏洞

BUGTRAQ ID: 31288 CNCAN ID：CNCAN-2008092307 Invision Power Board是一款基于PHP的论坛程序。 Invision Power Board不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或可操作数据库。 问题是脚本对'name'参数缺少过滤，构建恶意的SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Invision Power Services Invision Power Board 2.3.5 Invision Power Services Invision Power Boa...

Fedora 7 : otrs-2.1.5-4.fc7 (2008-3100)

Security update: Add upstream patch for CVE-2008-1515 / OSA-2008-01 Vulnerability in OTRS SOAP interface allowing remote access without valid SOAP user - http://otrs.org/advisory/OSA-2008-01-en/ Note that Tenable Network Security has extracted the preceding description block directly from the...

Debian Security Advisory DSA 674-1 (mailman)

The remote host is missing an update to mailman announced via advisory DSA 674-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Qvod Player 2.1.5 - 'QvodInsert.dll' ActiveX Control Remote Buffer Overflow

source: https://www.securityfocus.com/bid/27271/info Qvod Player 'QvodInsert.dll' ActiveX control is prone to is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue allows remote...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggierootpath parameter to 1 config.php; 2 db.php, 3 template.php, 4 functions.php, and 5 classes.php in includes/; 6 viewmode.php; and 7 blogbody.php. NOT...

CVE-2007-3194

Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggierootpath parameter to 1 config.php; 2 db.php, 3 template.php, 4 functions.php, and 5 classes.php in includes/; 6 viewmode.php; and 7 blogbody.php. NOT...

CVE-2007-3194

Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggierootpath parameter to 1 config.php; 2 db.php, 3 template.php, 4 functions.php, and 5 classes.php in includes/; 6 viewmode.php; and 7 blogbody.php. NOT...

CVE-2007-3194

CVE-2007-3194 affects myBloggie 2.1.5. The issue is described as remote PHP file inclusion via a URL in bloggie_root_path to files including includes/config.php, includes/db.php, includes/template.php, includes/functions.php, includes/classes.php, viewmode.php, and blog_body.php. The root cause i...

PT-2007-4474 · Mybloggie · Mybloggie

Name of the Vulnerable Software and Affected Versions: myBloggie version 2.1.5 Description: The issue allows remote attackers to potentially execute arbitrary PHP code via a URL in the bloggie root path parameter to several PHP files, including config.php, db.php, template.php, functions.php,...

myBloggie 2.1.5 Remote File Include

myBloggie 2.1.5 RFI Author: Yaser [email protected] Homepage: http://www.ayyildiz.org Download S : http://mywebland.com/download.php?id=19 Exploits: http://site/config.php?bloggierootpath=evilcode? http://site/includes/db.php?bloggierootpath=evilcode?...

mybloggie-rfi.txt

myBloggie 2.1.5 RFI Author: Yaser Homepage: http://www.ayyildiz.org Download S : http://mywebland.com/download.php?id=19 Exploits: http://site/config.php?bloggierootpath=evilcode? http://site/includes/db.php?bloggierootpath=evilcode? http://site/includes/template.php?bloggierootpath=evilcode?...

otscms-multi.txt

Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://sourceforge.net/project/showfiles.php?groupid=145557 ; Found by = GregStar gregstaratc4f.pl http://c4f.pl ;...

OTSCMS <= 2.1.5 (SQL/XSS) Multiple Remote Vulnerabilities

No description provided by source. Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://s...

otscms 2.1.5 - SQL Injection / Cross-Site Scripting

Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://sourceforge.net/project/showfiles.php?groupid=145557 ; Found by = GregStar gregstaratc4f.pl http://c4f.pl ;...

mybloggie215-xss.txt

-=--------------------ADVISORY-------------------=- myBloggie 2.1.5 Author: CorryL [email protected] -=-------------------------------------------------------=- -=+ Application: myBloggie -=+ Version: 2.1.5 -=+ Vendor's URL: http://mywebland.com/download.php?id=19 -=+ Platform: Windows\Linux\Uni...

CVE-2007-0353

CVE-2007-0353 is an XSS vulnerability in myBloggie 2.1.5 affecting (1) index.php and (2) login.php. The issue arises from user-supplied PATH_INFO, allowing remote attackers to inject arbitrary web script or HTML. Connected sources corroborate the affected components and vector; no patch/version r...

[x0n3-h4ck] myBloggie 2.1.5 XSS exploit

-=--------------------ADVISORY-------------------=- myBloggie 2.1.5 Author: CorryL [email protected] -=-------------------------------------------------------=- -=+ Application: myBloggie -=+ Version: 2.1.5 -=+ Vendor's URL: http://mywebland.com/download.php?id=19 -=+ Platform: WindowsLinuxUnix...

MyBloggie 2.1.5 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...

MyBloggie 2.1.5 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an...

MyBloggie 2.1.5 - login.php Cross-Site Scripting

MyBloggie 2.1.5 - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/22097/info MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary...