CVE-2006-5131

module/shout/jafshout.php aka the shoutbox in ph03y3nk just another flat file JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "", possibly due to a static code injection vulnerability involving admin/datainc.php...

JAFCMS-4.0.txt

Hacker: NanoyMaster /|| \ | || \ / ||\ Exploit: JAF CMS / || |\| || / || \ Version: 4.0 RC1 \ || | \ || |/| || / ||| ||| |||/ vulnerabilities: XSS in shoutbox PHP execution XSS in forum \m/Props\m/ z3r0phr34k SystemMeltdown THK-GEO & THK-h3x All of Exploitarians...

CVE-2006-5129

Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via 1 the message parameter, and possibly other parameters, in module/shout/jafshout.php aka the shoutbox; and 2 the message body in a...

CVE-2006-5129

CVE-2006-5129 affects ph03y3nk just another flat file (JAF) CMS 4.0 RC1. The vulnerabilities are cross-site scripting in two spots: (1) module/shout/jafshout.php (the shoutbox) via the message parameter and related name/email/title/date/ldate/lname variables, and (2) the message body in a forum p...

Digishop 4.0 - cart.php Cross-Site Scripting

Digishop 4.0 - cart.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20297/info digiSHOP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to have arbitrary script code execute in the...

MS03-026 Microsoft RPC DCOM Interface Overflow

This module exploits a stack buffer overflow in the RPCSS service, this vulnerability was originally found by the Last Stage of Delirium research group and has been widely exploited ever since. This module can exploit the English versions of Windows NT 4.0 SP3-6a, Windows 2000, Windows XP, and...

CVE-2006-4828

PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6 allows remote attackers to execute arbitrary PHP code via a URL in the PPPATH parameter...

CVE-2006-4828

CVE-2006-4828 is a PHP remote file inclusion vulnerability in PhotoPost (versions 4.0–4.6). The flaw allows remote attackers to execute arbitrary PHP code by supplying a URL in the PP_PATH parameter of zipndownload.php. This is a classic RFI condition where a user-supplied URL is used to include ...

CVE-2006-4668

CVE-2006-4668 describes an XSS in Rob Hensley AckerTodo 4.0. The vulnerability resides in index.php where the task_id parameter used in an edit_task command can be exploited by remote attackers to inject arbitrary web script or HTML. Public references confirm the affected component as AckerTodo 4...

AckerTodo 4.0 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19894/info AckerTodo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue would allow an attacker to steal cookie-based credentials and to launch other attacks. Version 4.0 is...

CVE-2006-3942

The server driver srv.sys in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service system crash via an SMBCOMTRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the...

CVE-2006-3819

CVE-2006-3819 affects TWiki 4.0.0 to 4.0.4. The vulnerability is an eval injection in the configure script, allowing remote attackers to execute arbitrary Perl code via an HTTP POST containing a parameter name that starts with “TYPEOF.” The issue enables remote code execution with the web server’...

CVE-2006-3519

CVE-2006-3519 concerns multiple XSS flaws in The Banner Engine (tbe) 4.0. The NVD entry documents that remote attackers can inject arbitrary web script/HTML via: (a) the text parameter in a search action to top.php, and (b) the adminpass or (c) adminlogin parameter to signup.php. The accompanying...

TBE 4.0 XSS

The Banner Engine - tbe4.0 Native Solutions -------------------------- Cross Site Scripting XSS -------------------------- http://target.xx/top.php?action=search&catid=catid&text=3Cscript3Ealert22Ellipsis+Security+Test223C/script3E...

Microsoft DXImageTransform.Microsoft.Light ActiveX Control Remote Code Execution Vulnerability

Description The DXImageTransform.Microsoft.Light ActiveX control is prone to remote code execution. An attacker could exploit this issue to execute code in the context of the user visiting a malicious web page. Technologies Affected Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer...

Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability Variant

Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability that is related to the instantiation of COM objects. This issue results from a design error. The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX...

TFTPD32 Long Filename Buffer Overflow

This module exploits a stack buffer overflow in TFTPD32 version 2.21 and prior. By sending a request for an overly long file name to the tftpd32 server, a remote attacker could overflow a buffer and execute arbitrary code on the system. This module requires Metasploit:...

[Full-disclosure] Secunia Research: CAM UnZip ZIP File Handling Buffer Overflow Vulnerability

====================================================================== Secunia Research 19/05/2006 - CAM UnZip ZIP File Handling Buffer Overflow Vulnerability - ====================================================================== Table of Contents Affected...

Code injection

Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service crash via a BuildContextW request with a large 1 UuidString or 2 GuidIn of a certain length, which causes an out-of-range memory...

[EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow

Microsoft Distributed Transaction Coordinator Heap Overflow http://www.eeye.com/html/research/advisories/AD20060509a.html Release Date: May 9, 2006 Date Reported: October 11, 2005 Patch Development Time In Days: 210 Severity: High Remote Code Execution Systems Affected: Windows NT 4.0 Windows 200...