auracms-admin.txt

!/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ AuraCMS 2.2 - adminusers.php Remote Add Administrator Exploit Waktu : Dec 25 2007 04:50AM Software : AuraCMS 2.2 Vendor : http://www.auracms.org/ Ditemukan oleh : k1tk4t | http://newhack.org Lokasi : Indonesi...

CVE-2007-6552

AuraCMS 2.2 contains a directory traversal vulnerability in index.php: remote authenticated users can include and execute arbitrary local files by supplying a .. (dot dot) in the act parameter, potentially involving the news pilih component. The example given is including admin/admin_users.php to...

FreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)

The Gallery team reports : Gallery 2.2.4 addresses the following security vulnerabilities : - Publish XP module - Fixed unauthorized album creation and file uploads. - URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...

gallery2 -- multiple vulnerabilities

The Gallery team reports: Gallery 2.2.4 addresses the following security vulnerabilities: Publish XP module - Fixed unauthorized album creation and file uploads. URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...

PHP 5.2.4及之前版本存在多个漏洞

PHP是一款流行的网络编程语言。 PHP存在多个安全问题，远程攻击者可以利用漏洞进行缓冲区溢出，拒绝服务，和安全绕过攻击。 -dl处理文件名存在问题，可导致跨站脚本攻击。 -dl处理MAXPATHLEN参数大小存在问题，可导致拒绝服务攻击。 -tmlentities/htmlspecialchars处理部分多字节序列存在问题。 -fnmatch, setlocale和glob函数的glibc实现存在缓冲区溢出。 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 12.0 Slackware Linux 11.0...

Fedora 7 : gallery2-2.2-0.7.svn20070831.fc7 (2007-2020)

Security fix release for Gallery 2.2 series. CVE text: Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to 1 rename items, 2 read and modify item properties, or 3 lock and replace items via unknown vectors in a the WebDAV module; and 4 edit unspecified data files using...

CVE-2003-1458

CVE-2003-1458 affects ttCMS 2.2 and ttForum via a SQL injection vulnerability in Profile.php, exploitable through the member name to execute arbitrary SQL commands. The vulnerability is remote and the documented impact is partial confidentiality, integrity, and availability. Exploitation details ...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 encopyrite.php, 2 vicopyrite.php, and 3 arcopyrite.php in language/ directories; 4 classaccess.php, 5 classdepartment.php, 6...

CVE-2007-5418

CVE-2007-5418 documents multiple PHP remote file inclusion flaws in CARE2X versions (notably 1.1 and 2G 2.2) that allow an attacker to execute arbitrary PHP code. The vulnerability is triggered by supplying a URL in the root_path parameter to a set of PHP scripts across include/ and main/ directo...

CVE-2007-4807

Multiple PHP remote file inclusion vulnerabilities in Focus/SIS 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the staticpath parameter to 1 modules/Discipline/CategoryBreakdownTime.php or 2 modules/Discipline/StudentFieldBreakdown.php...

CVE-2007-4807

CVE-2007-4807 is a remote file inclusion vulnerability affecting Focus SIS 2.2. The issue arises from unsanitized input in the staticpath parameter, allowing an attacker to supply a URL to (1) modules/Discipline/CategoryBreakdownTime.php or (2) modules/Discipline/StudentFieldBreakdown.php and exe...

FocusSIS 1.02.2 - Remote File Inclusion

FocusSIS 1.02.2 - Remote File Inclusion Focus/SIS =1.0&2.2 Remote file inclusion Download v1.0 : http://unix.freshmeat.net/redir/focussis/64492/urlzip/Focusv1.0.zip v2.2 : http://www.focus-sis.org/download.php?modfunc=file&version=2.2...

Focus/SIS 1.0/2.2 - Remote File Inclusion

Focus/SIS =1.0&2.2 Remote file inclusion Download v1.0 : http://unix.freshmeat.net/redir/focussis/64492/urlzip/Focusv1.0.zip v2.2 : http://www.focus-sis.org/download.php?modfunc=file&version=2.2...

CVE-2007-4014

CVE-2007-4014 is an XSS issue in the index.php installation script associated with WordPress themes Blix 0.9.1, Blixed 1.0, and BlixKrieg 2.2, where the s parameter can inject arbitrary script/HTML. Connected records also describe a related CVE-2007-4165/XSS in the Blue Memories theme 1.5 for Wor...

CVE-2007-3711

Unspecified vulnerability in TOS 2.1.x, 2.2.x before 2.2.5, and 2.5.x before 2.5.2 on TippingPoint IPS allows remote attackers to avoid detection by sending certain fragmented packets...

Code injection

Unspecified vulnerability in TOS 2.1.x, 2.2.x before 2.2.5, and 2.5.x before 2.5.2 on TippingPoint IPS allows remote attackers to avoid detection by sending certain fragmented packets...

CVE-2007-3627

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3627

CVE-2007-3627 concerns PHP Lite Calendar Express 2.2 with multiple SQL injection flaws exploitable via the cid parameter in login.php, auth.php, and subscribe.php. The vulnerability allows remote attackers to inject arbitrary SQL commands. The note states that month.php, year.php, week.php, and d...

wppass-redirect.txt

The vulnerability found could allow an attacker to redirect victims to an arbitrary 3rd party site. This site could be a phishing site or contain malware allowing the attacker to steal account credentials or compromise hosts. This vulnerability can be found in Wordpress 2.2, however it is likely...

wordpresstheme-xss.txt

There is an XSS in the Wordpress default theme. Tested on WordPress version 2.2 Filename functions.php, line 387. Code: " $SERVER'REQUESTURI' is directly echoed to the user. This problem can be exploited if the adminstrator is logged in. Sample exploit URL...