Information disclosure

The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information...

Design/Logic Flaw

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

Code injection

BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address...

CVE-2006-2470

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

CVE-2006-2470

Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies...

CVE-2006-2470

Technical details about CVE-2006-2470 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2006-2468

The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information...

CVE-2006-2468

Vulnerability details for CVE-2006-2468 show that BEA WebLogic Server Administration Console exposes the domain name in the login form for BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6. The underlying issue is information disclosure in the Console login interface, which can allow remote att...

SAP sapdba for Informix database administration utility privilege escalation

Improper environment cariables validation allows to run any command with informix rights...

IPSwitch What's Up administration authentication bypass

It's possible to bypass authentication by adding User-Application: NmConsole header...

Cisco Secure ACS for Windows information leak

Administration password and encryption key are insecurely stored in HKEYLOCALMACHINE registry key...

OpenFAQ - HTML injection and XSS (Cross Site Scripting)

Script: OpenFAQ Version: 0.4.0 previous version probably too. Language: PHP Problem: HTML injection and XSS Cross Site Scripting Vendor: http://sourceforge.net/projects/openfaq Discovered by: Kamil 'K3' Sienicki Description: OpenFAQ is a PHP application that lets Webmasters administrate a...

Sql injection

Multiple SQL injection vulnerabilities in the report interface in Network Administration Visualized NAV before 3.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2006-2123

CVE-2006-2123 affects Network Administration Visualized (NAV) prior to version 3.0.1. The NAV report interface contains multiple SQL injection vulnerabilities that could allow a remote attacker to execute arbitrary SQL commands via unknown vectors. The underlying issue is untrusted input handling...

W-Agora 4.20 XSS

PLEASE NOTE: I am not sure if HTML is an option. I looked through the Administration panel and did not see an option for it, and the fact that there is no BBcode leads me to believe that this is the method of BBCode/etc. W-Agora is a fairly 'nice' bulletin board written in PHP. It allows multiple...

[SA19849] Network Administration Visualized SQL Injection Vulnerability

TITLE: Network Administration Visualized SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19849 VERIFY ADVISORY: http://secunia.com/advisories/19849/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Network Administration Visualized 3.x...

Code injection

Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 $themefontcolor3 variable and/or signature values, possibly involving the highlight functionality. NOTE: the original report does not clari...

CVE-2006-1896

CVE-2006-1896 concerns a vulnerability in phpbb2 where admin users with access to the Admin Panel can cause arbitrary PHP code execution via the Font Colour 3 setting due to insufficient input sanitisation. Debian/DSA-1066-1 documents that the issue arises from how values are sanitised for Font C...

CVE-2006-1756

MD News 1 is affected by CVE-2006-1756: remote attackers can bypass authentication via a direct request to a script in the Administration Area. The vulnerability enables auth bypass, with CVSS v2.0 base metrics: 7.5 (HIGH) with Network attack vector, Low complexity, no user interaction. Impact de...

Cross site scripting

Cross-site scripting XSS vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitrary web script or HTML and gain leverage to execute arbitrary PHP code via the User-Agent HTTP header, which is displayed by...