Design/Logic Flaw

The copytouser function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations...

CVE-2007-6416

The copytouser function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations...

Bugzilla User.pm非授权创建帐户绕过访问验证漏洞

Bugzilla是一种流行的开源软件Bug跟踪系统。 Bugzilla的实现上存在漏洞，远程攻击者可能利用此漏洞非授权创建帐户获取对系统的访问。 Bugzilla的User.pm模块的offeraccountbyemail函数没有对createemailregexp参数做充分的检查过滤，如果系统上安装了SOAP::Lite Perl模块，那么远程攻击者可能利用此漏洞在系统上创建Bugzilla用户帐号，从而获取对系统的访问。 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.0.2 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

confixx312.txt

// Confixx 3.1.2 XSSdiv style= - Googledork: inurl:confixx inurl:login|anmeldung + Greetz to: Bluegeek + Visit: www.LoK-Crew.de...

Cross site scripting

Cross-site scripting XSS vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the login parameter...

CVE-2006-2423

Cross-site scripting XSS vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the login parameter...

Confixx 3.1.2 <= Code Injection

// Confixx 3.1.2 = Code Injection // ----------------------------------------------------------------- Advisory by: LoK-Crew - Exploit: http://www.example.com/ftplogin/?login="XSSdiv style= - Googledork: inurl:confixx inurl:login|anmeldung + Greetz to: Bluegeek + Visit: www.LoK-Crew.de...

confixx_exploit.pl.txt

sry - i know this isn't a cvs repository here - but the code posted yesterday was written after some 'b33r' an i made it looking a little less drunk this morning. bye defa ----BOF---- !/usr/bin/perl exploit for confixx professional = 3.1.2 the vulerability was discovered by: LoK Crew references:...

CVE-2006-1759

CVE-2006-1759 describes a Cross-site Scripting (XSS) vulnerability in SWSoft Confixx 3.1.2, specifically in the file allgemein_transfer.php . The issue arises through the jahr parameter, enabling remote attackers to inject arbitrary web script or HTML. The entry notes the vulnerability as applica...

Confixx 3.1.2 <= SQL Injection

// Confixx 3.1.2 = SQL Injection // ----------------------------------------------------------------- Advisory by: LoK-Crew Snake23 - Exploit: http://www.victim.com/user/index.php?SID=SQL - Googledork: inurl:confixx inurl:login|anmeldung + Greetz to: Bluegeek and Team.Rootbox + Visit:...

Confixx 3.1.2 <= Cross Site Scripting Vuln

// Confixx 3.1.2 = Cross Site Scripting Vuln // ----------------------------------------------------------------- Advistory by: LoK-Crew Snake23 - Exploit: http://www.victim.com/allgemeintransfer.php?monat=4&jahr=XSS - Googledork: - + Greetz to: Bluegeek and Team.Rootbox + Visit: www.LoK-Crew.de....

SWSoft Confixx 3.1.2 - 'Jahr' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17466/info Confixx is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of a...

CVE-2005-4394

Cross-site scripting XSS vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters...

CVE-2005-4394

Cross-site scripting XSS vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters...

CVE-2005-4394

EPiX 3.1.2 and earlier versions are affected by a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters. The connected documents confirm the affected product and the general class of flaw but do not pro...

duportal2.txt

This is a multi-part message in MIME format. ------=NextPart000000801C545EE.4A553BC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Dcrab 's Security Advisory Hsc Security Group http://www.hackerscenter.com/ dP Security http://digitalparadox.org/ Ge...

CVE-2005-1236

Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the 1 iChannel parameter to channel.asp or search.asp, 2 iData parameter to detail.asp or incrating.asp, 3 iCat parameter to detail.asp or type.asp, 4 DATPARE...

DUportal 3.1.2 - inc_rating.asp Multiple SQL Injections

DUportal 3.1.2 - incrating.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/13288/info DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL...

DUportal 3.1.2 - inc_poll_voting.asp?DAT_PARENT SQL Injection

DUportal 3.1.2 - incpollvoting.asp?DATPARENT SQL Injection source: https://www.securityfocus.com/bid/13288/info DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in S...

DUportal 3.1.2 - 'type.asp?iCat' SQL Injection

source: https://www.securityfocus.com/bid/13288/info DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...