CVE-2007-6012

CVE-2007-6012 is a SQL injection in DocuSafe 4.1.0 and 4.1.2, exploitable via the artnr parameter in SearchR.asp to execute arbitrary SQL commands. Affected component: SearchR.asp in DocuSafe; root cause is unsafely concatenated/artnr input. Impact described as remote attackers may run arbitrary ...

Liferay Portal 4.1 Login Script - Cross-Site Scripting

Liferay Portal 4.1 Login Script - Cross-Site Scripting source: https://www.securityfocus.com/bid/26470/info Liferay Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...

MDPro 1.0.76 Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================= MDPro 1.0.76 Remote SQL Injection Exploit ========================================= !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author =...

tomcat accept-language xss flaw

Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...

[CVE-2007-1355] Tomcat documentation XSS vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-1355: Tomcat documentation XSS vulnerabilities Severity: Moderate Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.0.0 to 4.0.6 Tomcat 4.1.0 to 4.1.36 Tomcat 5.0.0 to 5.0.30 Tomcat 5.5.0 to 5.5.23 Tomcat...

CVE-2007-0669

Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...

Design/Logic Flaw

Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...

CVE-2007-0302

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

InstantASP 4.1 - 'Logon.aspx?sessionid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22052/info InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and...

InstantASP 4.1 - 'Members1.aspx' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/22052/info InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and...

blog-cms410.txt

BLOG:CMS 4.1.0 http://blogcms.com ------------- SQL injection ------------- http://target.xx/?1'SQL http://target.xx/?item='SQL http://target.xx/?blog='SQL http://target.xx/?member='SQL http://target.xx/?typeface=1'SQL http://target.xx/?results='SQL http://target.xx/?DokuWiki='SQL...

BLOG:CMS 4.1.0 SQL injection File Include Vulnerability

BLOG:CMS 4.1.0 http://blogcms.com ------------- SQL injection ------------- http://target.xx/?1'SQL http://target.xx/?item='SQL http://target.xx/?blog='SQL http://target.xx/?member='SQL http://target.xx/?typeface=1'SQL http://target.xx/?results='SQL http://target.xx/?DokuWiki='SQL...

RealVNC 4.1.0 4.1.1 - VNC Null Authentication Scanner

RealVNC 4.1.0 4.1.1 - VNC Null Authentication Scanner class101 - http://heapoverflow.com RealVNC 4.1.0 - 4.1.1 VNC Null Authentication Vulnerability Scanners --------------------------------------------------------------------- windows:...

RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass

xx vnc-411-unixsrc.bl4ck/common/rfb/CConnection.cxx --- vnc-411-unixsrc/common/rfb/CConnection.cxx 2005-03-11 09:08:41.000000000 -0600 +++ vnc-411-unixsrc.bl4ck/common/rfb/CConnection.cxx 2006-05-15 14:03:30.000000000 -0500 @@ -183,7 +183,12 @@ // Inform the server of our decision if secType !=...

RealVNC 4.1.0 4.1.1 - VNC Null Authentication Bypass (Metasploit)

RealVNC 4.1.0 4.1.1 - VNC Null Authentication Bypass Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core...

giflib/libunfig: NULL pointer dereference crash

libungif library before 4.1.0 allows attackers to cause a denial of service via a crafted GIF file that triggers a null dereference...

PhpMyFAQ 1.5.1 multiple vulnerabilities

2.31 23/09/2005 PhpMyFaq 1.5.1 SQL injection / board takeover / user info disclosure / path disclosure remote code / commands execution software: site: http://www.phpmyfaq.de/ description: "phpMyFAQ is a multilingual, completely database-driven FAQ-system. It supports various databases to store a...

CVE-2005-2480

The CVE-2005-2480 entry concerns Fusebox running on ColdFusion (Fusebox 4.1.0). The vulnerability is a cross-site scripting (XSS) flaw where the fuseaction parameter is not quoted in an error page, enabling an attacker to inject arbitrary script/HTML (demonstrated via index.cfm). Connected docume...

CVE-2005-2480

Cross-site scripting XSS vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm...

CVE-2005-2481

CVE-2005-2481 affects ColdFusion Fusebox 4.1.0. The issue is that a malformed or invalid fuseaction parameter allows remote attackers to cause an error message that leaks the full server path. Documents confirm the affected product and the nature of the information disclosure, but do not provide ...