Cross site scripting

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

CVE-2008-4448

CVE-2008-4448 describes a CSRF vulnerability in actions.php of Positive Software H-Sphere WebShell 4.3.10. An attacker can induce an admin to perform unauthorized actions by visiting a crafted link or IMG tag targeting (1) overkill, (2) futils, or (3) edit actions, effectively enabling file delet...

CVE-2008-4454: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EKINdesigns MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. dot dot in the lang parameter to actions.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-4447: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

CVE-2008-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the 1 overkill, 2 futils, or 3 edit actions...

Sql injection

Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the username parameter to actions.php, and unspecified other vectors...

CVE-2008-0141: Use of Insufficiently Random Values

actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action...

CVE-2008-0142: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the username parameter to actions.php, and unspecified other vectors...

CVE-2006-3514

PHP-Blogger 2.2.5 (and possibly earlier) has multiple cross-site scripting (XSS) vulnerabilities in admin/actions.php. The flaw allows remote attackers to inject arbitrary web script or HTML via the parameters: name, title, news, description, and sitename. The CVE notes only the presence of XSS w...

CVE-2006-3514: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in admin/actions.php in PHP-Blogger 2.2.5, and possibly earlier versions, allow remote attackers to execute arbitrary web script or HTML via the 1 name, 2 title, 3 news, 4 description, and 5 sitename parameters...