CVE-2006-0947

Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due...

NeoMail neomail.pl sort Parameter XSS

The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sort' parameter in the 'neomail.pl' script before using it to generate dynamic content. An attacker may be able to exploit this issue to inject...

Design/Logic Flaw

The genrandstring function in phpBB 2.0.19 uses insufficiently random data small value space to create the activation key "validation ID" that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or...

CVE-2006-0496

Cross-site scripting XSS vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding Cascading Style Sheets CSS property, which does not...

CVE-2006-0496

Cross-site scripting XSS vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding Cascading Style Sheets CSS property, which does not...

CVE-2006-0496

Cross-site scripting XSS vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding Cascading Style Sheets CSS property, which does not...

Security Best Practice: Protection against CIFS Brute-Force Attacks

CIFS is an extension to the Message Block Server SMB protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. In recent years we have witnessed various worms attempting to compromise and spread through Windows machines with weak, default...

MySQL 5.0 information leak?

Hi. I just upgraded to mysql 5.0.18 and started using all those cool new features. : But concerning VIEWs, I think the informationschema is too verbose to the user. I started creating a VIEW that searches information from several tables, mangles the data and gives the user a clean table with his...

Windows password weakness

Added: 12/19/2005 CVE: CVE-1999-0503 Background Passwords are the most commonly used method of authenticating users to a server. The combination of a login name and password is used to verify the identity of a user requesting access, and to determine what parts of the server the user has permissi...

CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...

DEBIAN-CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...

CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...

CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...

CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...

USN-226-1: Courier vulnerability

Patrick Cheong Shu Yang discovered a flaw in the user account handling of courier-authdaemon. After successful authorization, the Courier mail server granted access to deactivated accounts...

DSA-917-1 courier - programming error

Bulletin has no description...

[DRUPAL-SA-2005-007] Drupal 4.6.4 / 4.5.6 fixes XSS issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2005-007 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2005-007 Project: Drupal core Date: 2005-11-30 Security risk: less critical...

DRZES Hms 3.2 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/15644/info DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries. Successful exploitation could result in a compromise of the application...

CVE-2005-3687

cancelaccount.php in WHM AutoPilot 2.5.30 and earlier allows remote attackers to cancel requests for arbitrary accounts via a modified c parameter...

Successful invasion of the MSSQL database of alternative ideas-vulnerability warning-the black bar safety net

mssql injection of sa use Database and website put in the same server: Method a: Open TS, add accounts on the go, the specific statement is as follows: ;exec master. dbo. xpcmdshell '@echo Components c:\sql' ;exec master. dbo. xpcmdshell '@echo TSEnable = on c:\sql' ;exec master. dbo. xpcmdshell...