CVE-2008-4151

CVE-2008-4151 : Directory traversal in collect.php of CYASK 3.x allows remote attackers to read arbitrary files via a .. in the neturl parameter. Impact: read access to files. The provided documents do not include remediation details or patch/version information. Exploitation status is not specif...

CVE-2008-4151

Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. dot dot in the neturl parameter...

CYASK 3.x (collect.php neturl) Local File Disclosure Vulnerability

No description provided by source. This vulnerability leads to that the attacker can read any file on your webserver when it installs cyask. The $neturl variable in collect.php is short of enough check. When the attacker registers a new user, he can pass the user check and then submit any filenam...

CYASK 3.x (collect.php neturl) Local File Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================== CYASK 3.x collect.php neturl Local File Disclosure Vulnerability ================================================================== This vulnerability leads to that the...

CYASK 3.x - neturl Local File Disclosure

CYASK 3.x - neturl Local File Disclosure This vulnerability leads to that the attacker can read any file on your webserver when it installs cyask. The $neturl variable in collect.php is short of enough check. When the attacker registers a new user, he can pass the user check and then submit any...

microtik-poc.txt

/ -------------------------------------------------------------------------- c ShadOS 2008 | || || | | |/ / | || | | / - | | ' SNMP Service General Information Summary ... RouterOS supports only Get, which means that you can use this implementation only for network monitoring. The MikroTik Router...

CVE-2008-3367

CVE-2008-3367 describes a cross-site scripting (XSS) vulnerability in Web Wiz Rich Text Editor (RTE) 3.x and 4.x before 4.03, where attacker-supplied input in the email parameter to RTE_popup_link.asp can inject arbitrary script or HTML. Affected software is the Web Wiz RTE web component; root ca...

CVE-2008-3198

Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933...

CVE-2008-3198: Improper Control of Generation of Code

Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933...

Joomla Simple Shop Galore Component 3.x (catid) SQL Injection

Exploit for unknown platform in category web applications ============================================================= Joomla Simple Shop Galore Component 3.x catid SQL Injection =============================================================...

CVE-2008-2133

Cross-site scripting XSS vulnerability in the Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter in a new entry, as demonstrated by a CSS property in the STYLE attribute of a DIV element, a different vulnerability than...

CVE-2008-2134

CVE-2008-2134 affects the Journal module in Tru-Zone Nuke ET 3.x. An attacker can remotely obtain access to arbitrary user accounts and modify or delete data by supplying a modified username in an unspecified cookie. The vulnerability is documented in multiple sources (NVD entry CVE-2008-2134). T...

CVE-2008-2133

CVE-2008-2133 is an XSS vulnerability in the Journal module of Tru-Zone Nuke ET 3.x. The flaw allows remote attackers to inject arbitrary web script or HTML via the title parameter in a new entry, demonstrated by a CSS property in the STYLE attribute of a DIV element. Affected component: Journal ...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1960

Cross-site scripting XSS vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1960

CVE-2008-1960 describes a Cross-site Scripting (XSS) vulnerability in ContRay 3.x, affecting the CGI script cgi-bin/contray/search.cgi via the search parameter. Remote attackers can inject arbitrary web script or HTML. Per NVD data, the attack is network-delivery with medium complexity and no aut...

CVE-2008-1396: Undefined Security Weakness

Plone CMS 3.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...

CVE-2008-0737

CVE-2008-0737 is a SQL injection vulnerability in CandyPress (CP) 4.x/3.x, exploitable via the ASP script admin/utilities_ConfigHelp.asp. The vulnerability stems from insufficient sanitization of the helpfield parameter, allowing an unauthenticated attacker to modify database queries to disclose ...

CVE-2007-6668

CVE-2007-6668 affects admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x, where a missing requirement for administrative privileges enables remote attackers to upload arbitrary files (demonstrated with a .php file and a .php%00.jpeg). The connected records confirm the vulnerability’s existen...

MySpace Content Zone 3.x - Arbitrary File Upload

MySpace Content Zone 3.x - Arbitrary File Upload ---------------------------------------------------- +-MySpace Content Zone RFi-+ ---------------------------------------------------- Found By Don & breakerunit ---------------------------------------------------- Vuln file: /admin/uploadgames.php...