CVE-2008-2762

SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2758

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 pblname and 2 text parameters to a admin/search.asp, 3 name parameter to b admin/publishers.asp, and other unspecified...

CVE-2008-2761

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in 1 searchbanners.asp and 2 listadvertisers.asp, and other unspecified fields. NOTE: some of these...

CVE-2008-2757

The CVE-2008-2757 entry affects Xigla Absolute News Manager XE 3.2. Affected component: search.asp. Root cause: SQL injection via the orderby parameter, enabling remote authenticated administrators to execute arbitrary SQL commands. Impact: allows manipulation of backend databases (as described),...

CVE-2008-2757: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute News Manager XE 3.2 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2571

Cross-site request forgery CSRF vulnerability in LimeSurvey formerly PHPSurveyor before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LimeSurvey formerly PHPSurveyor before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action...

Zomplog <= 3.8.2 (newuser.php) Arbitrary Add Admin Exploit

No description provided by source. ======================== WEBXAKEP.NET =========================== Name: "Zomplog 3.8.2 = add admin" Version: All Script Download: http://www.zomp.nl/zomplog/ DORK: "powered by zomplog" Discovered By: ArxWolf Discovered On: 16 05 2008 WWW: http://WebXakep.net ICQ...

CVE-2008-2195

Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI...

Microsoft Outlook Web Access not may use correct HTTP directive

Overview Some versions of Outlook Web Access OWA may use the no-cache instead of the no-store HTTP 1.1 directive. This results in web browsers caching sensitive information. Description Some versions of Outlook Web Access may use the Cache-Control: no-cache HTTP 1.1 directive. From RFC 2616: If t...

Design/Logic Flaw

Unspecified vulnerability in Sun Ray Kiosk Mode 4.0 allows local and remote authenticated Sun Ray administrators to gain root privileges via unknown vectors related to utconfig...

Sql injection

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-2038

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1988

Unrestricted file upload vulnerability in the fileupload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file...

NetClassifieds Sql Injection

Aria-Security Team Persian Security Team http://Aria-Security.Net Persian http://Aria-Security.com ENG -------------------------------------------- Greetz: Aura, imm02tal, Null, Kinglet, Mormoroth http://www.scriptdevelopers.net/ tested on NetClassifieds Original Post @...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...

CVE-2008-1719

Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...

CVE-2008-1719

CVE-2008-1719 affects Nuke ET versions 3.2 and 3.4. The issue consists of multiple CSRF vulnerabilities that could allow remote attackers to perform actions as administrators, demonstrated via inserting an XSS sequence into a document. The provided documents do not specify a remediation or patch ...

SA-2008-025 - Simple access - Access bypass

The Simple Access module is a node access module that allows administrators to make some nodes private and/or editable by certain user roles. The module contains a flaw that results in the privacy information for a node being lost under certain conditions. These conditions are usually triggered v...

CVE-2008-1495

Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...