CVE-2007-0483

CVE-2007-0483 describes multiple cross-site scripting (XSS) vulnerabilities in Enthusiast 3.1. The issue arises from unsafely handling user-supplied input in the URI parameters for the pages "show_owned.php" and "show_joined.php", allowing remote attackers to inject arbitrary web script or HTML. ...

CVE-2007-0484

The CVE-2007-0484 entry describes multiple SQL injection vulnerabilities in Enthusiast 3.1. The issue arises in the server-side handling of the cat parameter for show_owned.php, show_joined.php, and possibly other files, enabling remote attackers to execute arbitrary SQL commands. The provided do...

CVE-2007-0483

Multiple cross-site scripting XSS vulnerabilities in Enthusiast 3.1 allow remote attackers to inject arbitrary web script or HTML via the URI for 1 showowned.php or 2 showjoined.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

[SA23865] Enthusiast Cross-Site Scripting and SQL Injection

TITLE: Enthusiast Cross-Site Scripting and SQL Injection SECUNIA ADVISORY ID: SA23865 VERIFY ADVISORY: http://secunia.com/advisories/23865/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: Enthusiast 3.x http://secunia.com/product/13303...

织梦(Dedecms)内容管理系统漏洞

织梦内容管理系统DedeCms 以简单、实用、开源而闻名，是国内最知名的PHP开源网站管理系统，也是使用户最多的PHP类CMS系统，在经历了二年多的发展，目前的版本无论在功能，还是是易用性方面，都有了长足的发展，DedeCms免费版的主要目标用户锁定在个人站长，功能更专注于个人网站或中小型门户的构建，当然也不泛有企业用户和学校等在使用本系统，据不完全统计，目前正在运行的使用DedeCms开发的网站已经超过一万个。 文件上传时，文件自命名名没过滤 “.” ，导致附件允许用 php 文件名 Dedecms 3.1...

[SECURITY] [DSA 1248-1] New libsoup packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1248-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 12nd, 2007 http://www.debian.org/security/faq -...

CVE-2006-6930

SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-0227

slocate 3.1 does not properly manage database entries that specify names of files in protected directories, which allows local users to obtain the names of private files. NOTE: another researcher reports that the issue is not present in slocate 2.7...

CVE-2006-6930

Rapid Classified 3.1 is affected by an SQL injection in viewad.asp via the id parameter, enabling remote execution of arbitrary SQL commands. Root cause: improper handling of the id input in viewad.asp. Affected component: Rapid Classified 3.1 (viewad.asp). Impact: arbitrary SQL execution with pa...

CVE-2006-6930

SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-6929

Multiple cross-site scripting XSS vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to a reply.asp or b viewprint.asp, the 2 SH1 parameter to c search.asp, the 3 name parameter to reply.asp, or the 4 dosearch parameter to ...

CVE-2006-6929

Rapid Classified 3.1 is affected by CVE-2006-6929 due to multiple cross-site scripting (XSS) vulnerabilities. The issue enables injection of arbitrary web script/HTML via parameters across several scripts: id in reply.asp and view_print.asp, SH1 in search.asp, name in reply.asp, and dosearch in a...

PT-2007-1209 · Rapid · Rapid Classified

Name of the Vulnerable Software and Affected Versions: Rapid Classified version 3.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various parameters in different scripts,...

[SECURITY] [DSA 1247-1] New libapache-mod-auth-kerb packages fix remote denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1247-1 [email protected] http://www.debian.org/security/ Noah Meyerhans January 08, 2007 - ------------------------------------------------------------------------ Package :...

TDiary未明远程代码执行漏洞

TDiary是一款类似WEBBLOG的日记软件。 TDiary存在一个未明安全问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 tDiary tDiary 2.0.3 tDiary tDiary 2.0.2 tDiary tDiary 2.0.1 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debi...

[SECURITY] [DSA 1214-2] Updated gv packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1214-2 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 27th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1239-1] New sql-ledger packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1239-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 17th, 2006 http://www.debian.org/security/faq -...

DSA-1237 kernel-source-2.4.27 - several

Bulletin has no description...

[SECURITY] [DSA-1236-1] New enemies-of-carlotta package fix missing sanity checks

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1236-1 [email protected] http://www.debian.org/security/ Steve Kemp December 13, 2006 -...

[SECURITY] [DSA-1236-1] New enemies-of-carlotta package fix missing sanity checks

------------------------------------------------------------------------ Debian Security Advisory DSA-1236-1 [email protected] http://www.debian.org/security/ Steve Kemp December 13, 2006 - ------------------------------------------------------------------------ Package : enemies-of-carlotta...