Sql injection

SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php...

CVE-2013-6341

SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php...

Possible DOS attack with long user-submitted passwords

More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...

CVE-2013-2245

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed...

Apache 2.2.x < 2.2.25 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.25. It is, therefore, potentially affected by the following vulnerabilities : - A flaw exists in the 'RewriteLog' function where it fails to sanitize escape sequences from being written to log files,...

OracleVM 2.2 : ovs-agent (OVMSA-2010-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update changelog, fill CVE number. - Fix config-file access mode issue. - Fix file access vulnerability orabug 10142417 CVE-2010-3582 - Fix local privilege escalation orabug 10142476 CVE-2010-3584 - F...

SA-CONTRIB-2013-057 - TinyBox - Cross Site Scripting (XSS)

TinyBox module uses TinyBox, a lightweight and standalone modal window script. The main purpose of this module is to provide Splash Screen/Window as simple as possible. The module doesn't filter user-supplied text prior to display. The vulnerability is mitigated by the fact that an attacker must...

KPPW 2.2 /control/ajax/ajax_file.php 任意文件下载漏洞

No description provided by source...

RadioCMS 2.2 - menager.php?playlist_id SQL Injection

RadioCMS 2.2 - menager.php?playlistid SQL Injection + + Title: RadioCMS 2.2 + Author: RoosterXEKA + Greetz to: Isis,luz3r,slider + Contact: forum.xeksec.com + -- Vuln Code -- ... if $GET'playlistid' $playlistidget = 'playlistid'; ... if $playlistid != "" $query = "SELECT FROM playlist WHERE...

RadioCMS 2.2 - 'menager.php?playlist_id' SQL Injection

Title: RadioCMS 2.2 + Author: RoosterXEKA + Greetz to: Isis,luz3r,slider + Contact: forum.xeksec.com + -- Vuln Code -- ... if $GET'playlistid' $playlistidget = 'playlistid'; ... if $playlistid != "" $query = "SELECT FROM playlist WHERE $playlistid;"; ... -- Exploitable --...

CVE-2013-3531

SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlistid parameter...

Sql injection

SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlistid parameter...

Apache VCL improper input validation

CVE-2013-0267: Apache VCL improper input validation Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache VCL 2.1, 2.2, 2.2.1, 2.3, 2.3.1 Description: Some parts of VCL did not properly validate input data. This problem was present both in the Privileges portion of...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

Radio CMS 2.2 SQL Injection Vulnerability

Radio CMS version 2.2 suffers from a remote SQL injection vulnerability. + + Title: RadioCMS 2.2 + Author: RoosterXEKA + Greetz to: Isis,luz3r,slider + Contact: forum.xeksec.com + -- Vuln Code -- ... if $GET'playlistid' $playlistidget = 'playlistid'; ... if $playlistid != "" $query = "SELECT FROM...

Radio CMS 2.2 SQL Injection

Title: RadioCMS 2.2 + Author: RoosterXEKA + Greetz to: Isis,luz3r,slider + Contact: forum.xeksec.com + -- Vuln Code -- ... if $GET'playlistid' $playlistidget = 'playlistid'; ... if $playlistid != "" $query = "SELECT FROM playlist WHERE $playlistid;"; ... -- Exploitable --...

Core FTP < 2.2 build 1769 Multiple Buffer Overflows

The version of Core FTP installed on the remote host is prior to 2.2 build 1769 2.2.1768.0. It is, therefore, affected by multiple buffer overflow vulnerabilities because user-supplied input is not properly validated when handling directory names. A remote attacker could potentially exploit this...

CVE-2012-6100

report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report...

CVE-2012-6100

report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report...

Design/Logic Flaw

grade/edit/outcome/editform.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into...