CVE-2004-2411

The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting XSS attacks that do not use tags, as demonstrated via javascript in IMG tags to 1 the cat parameter in...

CVE-2004-2413

SQL injection vulnerability in VP-ASP Shopping Cart 4.0 through 5.0 allows remote attackers to execute arbitrary SQL commands via the 1 Processed0 and 2 Processed1 parameters in a POST request to shopproductselect.asp...

CVE-2004-2164

shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attackers to cause a denial of service connection consumption...

CVE-2004-2746

SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2004-1400

The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp...

CVE-2004-1401

SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter...

CVE-2004-2412

Multiple SQL injection vulnerabilities in VP-ASP Shopping Cart 4.0 through 5.0 allow remote attackers to execute arbitrary SQL commands via the catalogid parameter in 1 shopreviewlist.asp and 2 shopreviewadd.asp...

CVE-2004-1555

Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the 1 keywords parameter to search.asp, 2 handle parameter to profile.asp, 3 txtUserHandle parameter to reg2.asp or 4 txtUserEmail parameter to forgot.asp...

CVE-2004-2123

Multiple cross-site scripting XSS vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the 1 level parameter of productdetail.asp, 2 searchKey parameter of searchresults.asp, and possibly 3 level parameter of ListCategories.asp...

CVE-2004-1788

ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to main.mdb...

aspSQL.txt

-------------------www.karchack.com-------------------------- -------------------www.karchack.net-------------------------- affected software decribtion : asp-rider is a full farsi weblog written in asp www.asp-rider.com -------------------------------------- Vulnerabilities: the file verify.asp ...

[SA13470] ASP-rider "username" SQL Injection Vulnerability

TITLE: ASP-rider "username" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA13470 VERIFY ADVISORY: http://secunia.com/advisories/13470/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: ASP-rider http://secunia.com/product/4380/ DESCRIPTION: shervin...

CVE-2004-1261

Multiple buffer overflows in the preparse function in asp2php 0.76.23 allow remote attackers to execute arbitrary code via crafted ASP scripts...

ASP-rider is vulnerable to sql injection attack

-------------------www.karchack.com-------------------------- -------------------www.karchack.net-------------------------- affected software decribtion : asp-rider is a full farsi weblog written in asp www.asp-rider.com -------------------------------------- Vulnerabilities: the file verify.asp ...

ASP Calendar Vulnerability <www.ashiyane.com>

www.ashiyane.com Release by AcTiOnSpIdEr [email protected] Advisory Name: ASP Calendar Vulnerability Release Date:13 December 2004 Platform:Any website using asp Calendar Severity:no password protected ! Overview : ---------- ASP Calendar is a tool written in aps to handle the administration...

Ocean12 ASP Calendar Administrative Access

The remote host is running Ocean12 ASP Calendar, a web-based application written in ASP. There is a flaw in the remote software which may allow anyone execute administrative commands on the remote host by requesting the page /admin/main.asp. An attacker may exploit this flaw to deface the remote...

ASP2PHP 0.76.23 - Preparse Token Variable Buffer Overflow

source: https://www.securityfocus.com/bid/12014/info asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of tokens in ASP files. Since ASP files may originate from an...

ASP2PHP 0.76.23 - Preparse Token Variable Buffer Overflow

ASP2PHP 0.76.23 - Preparse Token Variable Buffer Overflow source: https://www.securityfocus.com/bid/12014/info asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of token...

ASP-Rider verify.asp username Parameter SQL Injection

The remote host appears to be running ASP-Rider, a set of ASP scripts designed to maintain a blog. There is a flaw in the remote software that could allow anyone to inject arbitrary SQL commands, which could in turn be used to gain administrative access on the remote host. %NASLMINLEVEL 70300 C...

Active Server Corner ASP Calendar 1.0 - Administrative Access

source: https://www.securityfocus.com/bid/11931/info ASP Calendar is reported prone to an unauthorized administrative access vulnerability. An unauthorized remote attacker can access an administrative script and potentially gain administrative access to the application. It is believed that this...