modifyform - 'modifyform.html' Remote File Inclusion

modifyform RFI author: mozi original post: http://darkcode.h1x.com/forum/ dork: inurl: modifyform.html?code= thanks: str0ke, d3hydr8 milw0rm.com 2007-09-18...

Immunity Canvas: AJAXFB_INCLUDE

Name| ajaxfbinclude ---|--- CVE| CVE-2007-4921 Exploit Pack| CANVAS Description| Ajax File Browser 3 Beta Remote File Inclusion Notes| CVE Name: CVE-2007-4921 VENDOR: Ajax File Browser Notes: None Repeatability: Infinite References: http://securityreason.com/exploitalert/2767 CVE Url:...

Cross site scripting

Cross-site scripting XSS vulnerability in tracking.php in PHP-Stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a different vector than CVE-2007-4334...

Immunity Canvas: JOOMLARADIOV5_INCLUDE

Name| joomlaradiov5include ---|--- CVE| CVE-2007-4923 Exploit Pack| CANVAS Description| Joomla Radio v5 Component Remote File Inclusion Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: Joomla CVE Url: https://vulners.com/cve/CVE-2007-4923 CVE Name: CVE-2007-4923...

CVE-2007-4913

ipskernel/classupload.php in Invision Power Board IPB or IP.Board 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with crafted image filenames to uploads/, where they are saved with a .txt extension and are not executable. NOTE: there are limited usage scenarios unde...

CVE-2007-4918

CVE-2007-4918 describes a SQL injection in Gelato’s web app: classes/gelato.class.php vulnerable to arbitrary SQL via the post parameter to index.php . Affected: Gelato (web application). Root cause: unsafely constructed SQL from user input (no sufficient input validation/sanitization). Impact: r...

CVE-2007-3654

The CVE-2007-3654 issue affects NetBSD: display driver allocattr functions in NetBSD 3.0 through 4.0_BETA2, and NetBSD-current before 20070728. The root cause is improper validation in an ioctl call within the vga_allocattr path, allowing a local attacker to trigger a denial-of-service (panic) by...

CVE-2007-4912

CVE-2007-4912 describes a cross-site scripting (XSS) vulnerability in IPB/IP.Board, specifically in ips_kernel/class_ajax.php, affecting version 2.3.1 up to 20070912. The vulnerability allows remote attackers to inject arbitrary script/HTML into user profile fields via unspecified vectors related...

CVE-2007-4920

The CVE-2007-4920 entry concerns a SQL injection vulnerability in soporte_derecha_w.php for PHP Webquest 2.5 and earlier. The vulnerability is triggered via the id_actividad parameter, enabling remote attackers to execute arbitrary SQL commands. This affects the specified PHP file/version family ...

CVE-2007-4917

CVE-2007-4917 is an XSS vulnerability in tracking.php of PHP-Stats 0.1.9.2. The issue allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a vector distinct from CVE-2007-4334. The connected records corroborate the vulnerability’s existence in P...

CVE-2007-4914

CVE-2007-4914 affects Invision Power Board (IPB/IP.Board) 2.3.1 prior to 20070912. The issue, described across multiple sources, is an unspecified vulnerability in the subscriptions manager that lets remote authenticated users change the member ID and thereby reduce the privilege level of arbitra...

CVE-2007-4915

The CVE-2007-4915 issue affects Boa 0.93.x to 0.94.11 with Intersil isl3893 extensions, where stack writes can overwrite memory locations used for string constants. This allows a remote attacker to change the admin password stored in memory through a long username in an HTTP Basic Authentication ...

CVE-2007-4916

CVE-2007-4916 is a heap-based buffer overflow in Microsoft Foundation Class (MFC) Library’s FileFind::FindFile() used by MFC42.dll/MFC42u.dll/MFC71.dll/MFC71u.dll and by Hewlett-Packard HP-related software (hpqutil.dll 2.0.0.138, HP All-in-One, Photo & Imaging Gallery 1.1). The overflow occurs wh...

CVE-2007-4910

CVE-2007-4910 concerns an unspecified vulnerability in netInvoicing prior to 2.7.3, with an unclear impact and attack vectors. The description links the issue to a component/string labeled “security check soap,” but concrete root-cause, affected modules, fixes, or exploit details are not provided...

CVE-2007-4910

Unspecified vulnerability in netInvoicing before 2.7.3 has unknown impact and attack vectors, related to "security check soap"...

CVE-2007-4911

CVE-2007-4911 affects JetCast Server 2.0.0.4308 where the DLL JSMP3OGGWt.dll can be triggered remotely to crash the daemon by sending a long ".mp3" URI to TCP port 8000. The description indicates a remote-denial-of-service condition via the network, with no public exploit details provided within ...

CVE-2007-4911

JSMP3OGGWt.dll in JetCast Server 2.0.0.4308 allows remote attackers to cause a denial of service daemon crash via a long .mp3 URI to TCP port 8000. NOTE: some of these details are obtained from third party information...

CVE-2007-4923

PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 comjoomlaradiov5 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfiglivesite parameter...

CVE-2007-4922

CVE-2007-4922 describes an SQL injection in the jeuxflash 1.0 module for KwsPHP. The vulnerability is in play.php (remote authenticated users) allowing arbitrary SQL execution via the id parameter in a play ac action to index.php. The description notes third-party details were used. Connected rec...

CVE-2007-4909

WinSCP (before 4.0.4) is affected by an interpretation conflict in its URL handler that lets remote attackers perform arbitrary file transfers via certain scp/sftp/ftp URLs, by abusing a login-as-username on the URL which is parsed differently by the protocol handler. The issue is described as a ...