XSS vulnerability in pagepicker.action and spacepagepicker.action

The following URL's are vulnerable: - /users/pagepicker.action - /users/spacepagepicker.action on formname, fieldname and currentspace panel:bgColor=99ff99 h4. Patch instructions for 2.6.x and 2.7.x 1. Shut down Confluence 2. Copy attached pagepicker.vm to confluence/users/ 3. Start up Confluence...

JIRA Portlet Macro not displaying when authenticating using the trusted application between JIRA and Confluence

We're having issues using the JIRA portlet macro jiraportlet on pages inside Confluence. Whenever we try to use this macro using the trust between JIRA and Confluence for authentication, the macro does not display on the page. There aren't any errors, it just doesn't appear. code...

CVE-2008-0257

The CVE-2008-0257 entry describes a Cross-site scripting (XSS) vulnerability in Dansie Search Engine 2.7, specifically in search.pl, exploitable via the keywords parameter. This allows remote attackers to inject arbitrary web script or HTML. The public records provided do not specify affected ver...

CVE-2007-6172

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewimage.php and 2 comments.php...

Sql injection

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewimage.php and 2 comments.php...

CVE-2007-6172

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewimage.php and 2 comments.php...

CVE-2007-6172

The CVE-2007-6172 entry affects wpQuiz 2.7, with multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the id parameter to viewimage.php and comments.php. The issue is confirmed across multiple sources in the connected documents, indicating a hig...

wpquiz-sql.txt

Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

wpQuiz 2.7 Multiple Remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ======================================================== wpQuiz 2.7 Multiple Remote SQL Injection Vulnerabilities ======================================================== Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability...

wpQuiz 2.7 - Multiple SQL Injections

wpQuiz 2.7 - Multiple SQL Injections Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

wpQuiz 2.7 - Multiple SQL Injections

Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

Remote file inclusion

PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the form parameter...

CVE-2007-5221

CVE-2007-5221 affects Poppawid 2.7, where PHP remote file inclusion is possible via a URL supplied to the form parameter in mail/childwindow.inc.php, allowing remote code execution by an attacker. The vulnerability is documented in multiple sources (e.g., NVD, CVE lists). Affected component is a ...

CVE-2007-4163

Multiple SQL injection vulnerabilities in IndexScript 2.7 and 2.8 before 20070726 allow remote attackers to execute arbitrary SQL commands via the 1 catid, 2 startid, 3 rowparentid, and 4 rowcatid parameters to unspecified components, related to use of these parameters within include/utils.php...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Webmatic before 2.7 have unknown impact and attack vectors, related to the "administration area."...

CVE-2007-3398

LiteWEB 2.7 allows remote attackers to cause a denial of service hang via a large number of requests for nonexistent pages...

Code injection

LiteWEB 2.7 allows remote attackers to cause a denial of service hang via a large number of requests for nonexistent pages...

CVE-2007-3398

LiteWEB 2.7 allows remote attackers to cause a denial of service hang via a large number of requests for nonexistent pages...

LiteWEB 2.7 404 Denial of Services

LiteWEB 2.7 404 Denial of Services ----------------------------------- if u send to the server more than 100 requests to nonexisting pages the server will stop to answer. Site: http://www.cmfperception.com/liteweb.html Found By Shay Priel aka Prili - impriliatgmail.com POC: ---- !/usr/bin/perl...

LiteWEB Web Server 2.7 - Invalid Page Remote Denial of Service

source: https://www.securityfocus.com/bid/24628/info LiteWeb webserver is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions. An attacker can exploit this issue to crash the affected application, denying further service to legitimate...