CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

Code injection

The GUI nod32.exe in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors...

CVE-2006-0951

The GUI nod32.exe in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors...

CVE-2006-0052

The attachment scrubber Scrubber.py in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service mailing list delivery failure via a multipart MIME message with a single part that has two blank lines between the first boundary an...

CVE-2006-1488

ActiveCampaign SupportTrio 2.5 allows remote attackers to obtain the full path of the server via invalid 1 article or 2 print parameters in a kb action to index.php, or 3 an invalid category parameter to modules/KB/pdf.php, which leaks the path in an error message...

CVE-2006-1488

ActiveCampaign SupportTrio 2.5 is affected. The issue exposes the server’s full path via error messages when handling (1) invalid article or (2) invalid print parameters in a kb action to index.php, or (3) an invalid category parameter to modules/KB/pdf.php. Root cause: error messages leak path i...

CVE-2006-1488

ActiveCampaign SupportTrio 2.5 allows remote attackers to obtain the full path of the server via invalid 1 article or 2 print parameters in a kb action to index.php, or 3 an invalid category parameter to modules/KB/pdf.php, which leaks the path in an error message...

ActiveCampaign SupportTrio 2.5 vuln.

ActiveCampaign SupportTrio 2.5 vuln. Vuln. discovered by : r0t Date: 28 march 2006 vendor:http://www.activecampaign.com/ affected versions: 2.50.2 orginal advisory:http://pridels.blogspot.com/2006/03/activecampaign-supporttrio-25-vuln.html Vuln. description: ActiveCampaign SupportTrio contains a...

Easy Forum 2.5 - New User Image File HTML Injection

Easy Forum 2.5 - New User Image File HTML Injection source: https://www.securityfocus.com/bid/16958/info Easy Forum is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated...

CVE-2006-0877

Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable...

Cross site scripting

Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable...

CVE-2006-0877

The CVE-2006-0877 entry refers to a Cross-Site Scripting vulnerability in Easy Forum 2.5 allowing remote injection of arbitrary script via the image variable. Connected sources confirm affected software (Easy Forum 2.5) and vulnerable script join.php with unsanitized image data; exploit code is a...

CVE-2006-0877

Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable...

[OpenPKG-SA-2006.005] OpenPKG Security Advisory (tin)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org [email protected] [email protected] OpenPKG-SA-2006.005 19-Feb-2006 Package: tin Vulnerability: buffer overflow OpenPKG Specific: no...

Directory traversal

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

CVE-2006-0235

SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php...

Sql injection

SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php...

CVE-2006-0235

The CVE-2006-0235 entry describes an SQL injection vulnerability in WhiteAlbum 2.5, exploitable remotely via the dir parameter to pictures.php. The affected component is WhiteAlbum 2.5, with root cause being an SQL injection that allows attackers to run arbitrary SQL commands. The NVD metrics rat...

CVE-2006-0235

SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php...

CVE-2005-4231

Cross-site scripting XSS vulnerability in Link Up Gold 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 link parameter to tellfriend.php, 2 phrase parameter to search.php in a searchlinksadvanced action, and the 3 direction or 4 sort parameter to articles.php...