Automne 4.1.0 Race Condition

// ------------------------------------------------------------------------ // Software................Automne 4.1.0 // Vulnerability...........Race Condition // Threat Level............Very Critical 5/5 // Download................http://en.automne-cms.org/ // Release Date............3/2/2011 //...

CVE-2011-0643

CVE-2011-0643 describes a CSRF vulnerability in the PHP Link Directory (phpLD) package, specifically in the admin/conf_users_edit.php handler of version 4.1.0. The underlying issue enables an attacker to hijack administrator authentication and perform actions that add a new administrator via the ...

Apache Tomcat User Enumeration

This module enumerates Apache Tomcat's usernames via malformed requests to jsecuritycheck, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default...

DynPG CMS 4.1.0 - popup.php counter.php Multiple Vulnerabilities

DynPG CMS 4.1.0 - popup.php counter.php Multiple Vulnerabilities DynPG CMS v4.1.0 Multiple Vulnerability fucking the Web Apps attack edition /\ \ /\ \ /\ /\ \ \ \ \L\ \ \ /'\ /\ \ \ ,\ \ \ \ \ /\ /\ \ /'\ \ , /\ \ /' \ /' \ \ \ /\ \ \ /'\ \ \ /\ \ \ /\ /\ \ \\ \ /\ /\ /\ \L\ \ \ ...

DynPG CMS v4.1.0 Multiple Vulnerabilities

Exploit for php platform in category web applications ========================================= DynPG CMS v4.1.0 Multiple Vulnerabilities ========================================= +Title : DynPG CMS Multiple Remote File Inclusion Vulnerability +Version: 4.1.0 Other or lower versions may also be...

DynPG CMS 4.1.0 Remote File Inclusion

fucking the Web Apps attack edition /\ \ /\ \ /\ /\ \ \ \ \L\ \ \ /'\ /\ \ \ ,\ \ \ \ \ /\ /\ \ /'\ \ , /\ \ /' \ /' \ \ \ /\ \ \ /'\ \ \ /\ \ \ /\ /\ \ \\ \ /\ /\ /\ \L\ \ \ \ \ \ \ \ /\ / \ \ \ /\ \\ \ \ \ \ \ \ \ \ \\ \ \ \ // // // ///////////L\ \ //...

DynPG CMS 4.1.0 - Multiple Vulnerabilities

DynPG CMS 4.1.0 - Multiple Vulnerabilities DynPG CMS v4.1.0 Multiple Vulnerability fucking the Web Apps attack edition /\ \ /\ \ /\ /\ \ \ \ \L\ \ \ /'\ /\ \ \ ,\ \ \ \ \ /\ /\ \ /'\ \ , /\ \ /' \ /' \ \ \ /\ \ \ /'\ \ \ /\ \ \ /\ /\ \ \\ \ /\ /\ /\ \L\ \ \ \ \ \ \ \ /\ / \ \ ...

discuz 4.1.0 index.php 跨站脚本漏洞

No description provided by source...

AZL-43780 CVE-2009-3560 affecting package ogdi 4.1.0-9

The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlo...

Directory traversal

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

Cross site scripting

Cross-site scripting XSS vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, relat...

CVE-2009-0781

Cross-site scripting XSS vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, relat...

CVE-2009-0256

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to 1 frontend and 2 backend authentication...

CVE-2008-2938

CVE-2008-2938 is a directory-traversal vulnerability in Apache Tomcat (affected: 4.1.0–4.1.37, 5.5.0–5.5.26, 6.0.0–6.0.16) that occurs when allowLinking and URIEncoding="UTF-8" are enabled. Exploitation could allow a remote attacker to read arbitrary server files via encoded traversal sequences i...

Directory traversal

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

tomcat accept-language xss flaw

Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...

CVE-2008-2038

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-2038

TurnKey Web Tools SunShop Shopping Cart 4.1.0 has multiple SQL injection vulnerabilities in admin/adminindex.php that allow remote authenticated administrators to execute arbitrary SQL commands via the (1) orderby and (2) sort parameters. This CVE entry notes provenance is unknown and details are...

CVE-2007-6055

CVE-2007-6055 is a cross-site scripting (XSS) vulnerability affecting Liferay Portal 4.1.0 and 4.1.1, exploitable via the login parameter in c/portal/login. The issue arises from a regression after an earlier fix, as noted in the description. Connected documents provide corroborating context (e.g...

CVE-2007-6012

SQL injection vulnerability in SearchR.asp in DocuSafe 4.1.0 and 4.1.2 allows remote attackers to execute arbitrary SQL commands via the artnr parameter aka the search section. NOTE: some of these details are obtained from third party information...