5281 matches found
POWERGAP ShopSystem - 's03.php' SQL Injection
source: https://www.securityfocus.com/bid/30558/info POWERGAP Shopsystem is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...
CVE-2008-3458
Vuln CVE-2008-3458 affects vTiger CRM prior to version 5.0.4 . The issue is inadequate access control that stores sensitive information under the web root, enabling remote attackers to read mail merge templates by directly requesting the wordtemplatedownload directory. This is confirmed across mu...
Team SHATTER Security Advisory: SQL Injection in Oracle Application Server (WWEXP_API_ENGINE)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory SQL Injection in Oracle Application Server WWEXPAPIENGINE Audust 4, 2008 Risk Level: High Affected versions: Oracle Application Server 9.0.4.3, 10.1.2.2 and 10.1.4.1 Remote exploitable: Yes No authentication required...
Pcshey Portal - 'kategori.asp' SQL Injection
source: https://www.securityfocus.com/bid/30534/info Pcshey Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...
Keld PHP-MySQL News Script 0.7.1 - 'login.php' SQL Injection
source: https://www.securityfocus.com/bid/30529/info Keld PHP-MySQL News Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application,...
GLSA-200807-13 : VLC: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200807-13 VLC: Multiple vulnerabilities Remi Denis-Courmont reported that VLC loads plugins from the current working directory in an unsafe manner CVE-2008-2147. Alin Rad Pop Secunia Research reported an integer overflow error in...
Minishowcase 09b136 (lang) Local File Inclusion Vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-034 Application: Minishowcase Image Gallery Versions Affected: v09b136 Vendor URL: http://minishowcase.frwrd.net Bug: Local File Include Exploits: YES Reported: 14.07.2008 Second report: 22.07.2008 Vendor...
EasyPublish 3.0 - read Multiple SQL Injections Cross-Site Scripting
EasyPublish 3.0 - read Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/30307/info EasyPublish is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include SQL-injection and cross-site...
Evaria ECMS 1.1 - DOCUMENT_ROOT Multiple Remote File Inclusions
Evaria ECMS 1.1 - DOCUMENTROOT Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/30262/info ECMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromi...
Maian Weblog 4.0 - Insecure Cookie Handling
-+================================================================================+- -+ Maian Weblog = v4.0 Insecure Cookie Handling Vulnerability +- -+================================================================================+- Discovered By: S.W.A.T. E-Mail: svvateamatyahoodotcom Script...
Mambo < 4.6.5 mos_user_template Local File Inclusion
The version of Mambo installed on the remote host fails to properly check user input to the 'mosusertemplate' cookie for directory traversal sequences before using it to include PHP code from a local file. An unauthenticated attacker may be able to exploit this issue to view arbitrary files or to...
PHP-Nuke 4ndvddb 0.91 Module - id SQL Injection
PHP-Nuke 4ndvddb 0.91 Module - id SQL Injection source: https://www.securityfocus.com/bid/30120/info The '4ndvddb' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue cou...
Joomla Component DBQuery <= 1.4.1.1 RFI Vulnerability
Exploit for unknown platform in category web applications ===================================================== Joomla Component DBQuery DBQuery February 2007 Green Mountain Information Technology Consulting/aut...
Open Digital Assets Repository System 1.0.2 - Remote File Inclusion
Open Digital Assets Repository System 1.0.2 - Remote File Inclusion source: https://www.securityfocus.com/bid/29881/info Open Digital Assets Repository System ODARS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploi...
Open Azimyt CMS <= 0.22 (lang) Local File Inclusion Vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-026 Application: Open Azimyt CMS Versions Affected: 0.22 minimal, 0.21 stable Vendor URL: http://azimyt.net/ Bug: Local File Include Exploits: YES Reported: 07.06.2008 Vendor Response: 08.06.2008 Solution...
Open Azimyt CMS <= 0.22 (lang) Local File Inclusion Vulnerability
Exploit for unknown platform in category web applications ================================================================= Open Azimyt CMS adminfolder."/lang/lang-system-".$SESSION'lang'.".php"; if!fileexists$SystemLangFile exitErrorLang::LangFilenotload; require$SystemLangFile; Example:...
GSC Privilege Escalation Exploit
Name: Michael Gray Website: www.ownerarium.net Contact: [email protected] Discovered Exploit: 06-05-2008 Vulnerable Software Title: GSC Vulnerable Version: = 2067 Severity: CRITICAL Website: http://www.getgsc.com Reported to vendor: Yes Actively exploited: Yes Exploit Discovery...
F5 FirePass Content Inspection Management XSS
F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...
PHP Address Book 3.1.5 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/29560/info PHP Address Book is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based...
Battle Blog 1.25 - 'comment.asp' SQL Injection
++ | hhh hhh aa ccccccc kk k EEEEEEEE RRRR TTTTTTTT NNN NN | | hhh hhh aa aa cc kk k E RR R ----------- TT NN N NN | | hhhhhhhh aaaaaaaa cc kkk EEEEEEE RR R ----------- TT NN N NN | | hhh hhh aa aa cc kk k E RR R TT NN NNN | | hhh hhh aa aa ccccccc kk k EEEEEEE RR R TT NN NN | | | ++ + Script Nam...