Cross site scripting

Cross-site scripting XSS vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of...

Debian Security Advisory DSA 1170-1 (gcc-3.4)

The remote host is missing an update to gcc-3.4 announced via advisory DSA 1170-1. Jürgen Weigert discovered that upon unpacking JAR archives fastjar from the GNU Compiler Collection does not check the path for included files and allows to create or overwrite files in upper directories. OpenVAS...

Debian: Security Advisory (DSA-1170)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

i-Gallery 3.4 - igallery.asp Remote Information Disclosure

i-Gallery 3.4 - igallery.asp Remote Information Disclosure source: https://www.securityfocus.com/bid/26348/info i-Gallery is prone to a remote information-disclosure vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized remote use...

CVE-2007-5776

Directory traversal vulnerability in igallery.asp in Blue-Collar Productions i-Gallery 3.4 allows remote attackers to read arbitrary files via encoded backslash sequences in the d parameter, as demonstrated by a "%5c../../%5c" sequence...

CVE-2007-5777

Blue-Collar Productions i-Gallery 3.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a base64-encoded password via a direct request for igallery.mdb...

CVE-2007-5777

CVE-2007-5777 affects Blue-Collar Productions i-Gallery 3.4. The vendor’s application stores sensitive information under the web root with insufficient access control, permitting remote attackers to download a file (igallery.mdb) containing a base64-encoded password via a direct request. The NVD ...

i-Gallery 3.4 bug crack password!

we can find file mdb of i-Gallery by link: http://www.hkp.com/igallery/database/igallery.mdb and can crack password on file igallery.mdb! because password is Base64! -------------------- with link : http://www.hkp.com/gallery/igallery.asp?d=5c../../5c we can view file on folder of site!...

CVE-2003-1486

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to 1 smileys.php, 2 quicklistrss.php, 3 purge.php, 4 news.php, 5 memberlist.php, 6 forumlistrss.php, 7 forumlistrdf.php, 8 forumlist.php, or 9 move.php, which leaks the...

Sql injection

SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS aka phpWordPress CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2007-3290

categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' quote character in the cid parameter, which reveals the path in a forced SQL error message...

CVE-2007-3293

SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via an article name, possibly involving the titulo parameter in article.php...

CVE-2007-3292

Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article...

CVE-2007-3290

CVE-2007-3290 affects LiveCMS 3.4 and earlier. The vulnerability is in categoria.php where a single quote in the cid parameter can trigger a forced SQL error and reveal the path to sensitive information. Documents consistently describe this as an information disclosure via error messages, resulti...

CVE-2007-3292

Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article...

CVE-2007-3293

SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type, as demonstrated by image/jpeg...

Link Request Contact Form 3.4 - Remote Code Execution

Link Request Contact Form 3.4 - Remote Code Execution -=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's...

lrcf-inject.txt

-=--------------------ADVISORY-------------------=- Link Request Contact Form v3.4 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Link Request Contact Form -=+ Version: 3.4 -=+ Vendor's URL:...