PHPFootball 1.6 - Remote Database Disclosure

Title : PHPFootball 1.6 show.php Remote Database Disclosure Vulnerability Author : ajann Contact : : S.Page : http://phpfootball.sourceforge.net $$ : Free Dork : inurl:/phpfootball/ DBREAD--------------------------------------------------------- http://target/path//show.php VARIABLES Example:...

lmmhi-xss.txt

Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...

CVE-2007-0003

pamunix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters...

Keep track of skipped the Windows System log on automatically-bug warning-the black bar safety net

Windows family all members in the system go to the desktop before, will pop up a user login interface, requires the user to enter a user name and password, only the input is correct before entering the system. This mechanism undoubtedly greatly enhance the security of the system, but for the...

Login Manager Multiple HTML Injections

Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...

Multiple F5 FirePass security vulnerabilities

URL restrictions bypass, crossite scripting. Restrictions bypass with dotless IP address. Acounts enumeration...

Design/Logic Flaw

Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp...

CVE-2006-6722

Bandwebsite aka Bandsite portal system 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php with the Login parameter set to 1...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...

CVE-2006-6221

2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request...

CVE-2006-6221

2X ThinClientServer Enterprise Edition prior to 4.0.2248 is vulnerable: an unauthenticated remote attacker can trigger a replay of the initial account creation request to create multiple administrative accounts. Root cause is an unauthenticated, replayable account-creation flow that allows adding...

CVE-2006-6221

2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request...

Chetcpasswd 2.x: multiple vulnerabilities

From Debian.org: "chetpasswd uses the HTTPXFORWARDEDFOR for authentication purposes.... Obviously, HTTPXFORWARDEDFOR is not a trusted variable, and can be spoofed by any scriptkiddie who can read the man page of wget .... Furthermore, this cgi script doesn't seem to implement any rate limiting fo...

CVE-2006-5909

CVE-2006-5909 concerns Paul Tarjan’s Stanford Conference And Research Forum (SCARF) prior to 20070227. The vulnerability is in generaloptions.php, which does not require admin privilege, allowing remote attackers to reconfigure the application or its user accounts. The available sources (NVD/NVD-...

CVE-2006-5909

generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...

DataWizard FTPXQ Default Accounts

The version of DataWizard FTPXQ that is installed on the remote host has one or more default accounts setup which can allow an attacker to read and / or write arbitrary files on the system. This script was written by Justin Seitz Per Justin : GPLv2 include"compat.inc"; if description set script...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5597

CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5569

FtpXQ Server 3.0.1 installs with two default testing accounts, which allows remote attackers to read or write arbitrary files via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information...