Global Centre Aplomb Poll 1.1 - 'vote.php?Madoa' Remote File Inclusion

source: https://www.securityfocus.com/bid/25138/info Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code...

CVE-2007-3383

CVE-2007-3383 is an XSS flaw in Apache Tomcat’s SendMailServlet (examples/jsp/mail/sendmail.jsp) affecting Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.36. The vulnerability allows remote attackers to inject arbitrary script/HTML via the From field (and possibly other fields) during error-message generation....

Unfixed XSS vulnerability at playwithyourmind.com

Security researcher FiSh, has submitted on 25/07/2007 a cross-site-scripting XSS vulnerability affecting playwithyourmind.com, which at the time of submission ranked 480457 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...

Alisveris Sitesi Scripti - 'index.asp' SQL Injection

source: https://www.securityfocus.com/bid/25005/info Alisveris Sitesi Scripti is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

CVE-2007-3816

JWIG Context-Dependent Template Calling DoS (CVE-2007-3816) is a denial-of-service/class vulnerability caused by loops of references to external templates. The issue may allow context-dependent attackers to degrade services, but third parties dispute whether privilege boundaries are crossed; some...

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine 22:57 15.06.2007 New bonus vulnerability in Google. In this case vulnerability not directly at Google’s site, like at MOSEB-15: Vulnerabilities at images.google.com, but in his search engine called Google Custom Search Engine also known...

Dating Gold 3.0.5 - 'secure.admin.php?int_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/24910/info AzDG Dating Gold is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute an arbitrary remote file containing malicious...

Mail Machine <= 3.989 Local File Inclusion Exploit

No description provided by source. !/usr/bin/perl -w Mail Machine Local File Include Exploit Vuln. v3.980, v3.985, v3.987, v3.988 and v3.989 ! Application homepage : http://www.mikesworld.net/mailmachine.shtml ! Author : H4 / Team XPK ! Contact : [email protected]...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Calendarix 0.7.20070307 - Multiple SQL Injections

Calendarix 0.7.20070307 - Multiple SQL Injections source: https://www.securityfocus.com/bid/24633/info Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2007-3265

CVE-2007-3265 is a Cross-site scripting (XSS) vulnerability in the Samples component of IBM WebSphere Application Server (WAS) up to version 6.1.0.7 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected product: IBM WAS (Samples co...

FuseTalk 2.0/3.0 - 'AuthError.cfm' SQL Injection

source: https://www.securityfocus.com/bid/24528/info FuseTalk is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

freetype security update

CentOS Errata and Security Advisory CESA-2007:0403-01 Updated freetype packages that fix a security flaw are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. FreeType is a free,...

Mbedthis AppWeb 2.2.2 - URL Protocol Format String

Mbedthis AppWeb 2.2.2 - URL Protocol Format String source: https://www.securityfocus.com/bid/24454/info Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printin...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Joomla! Component JD-Wiki 1.0.2 - 'wantedpages.php?MosConfig_absolute_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/24342/info JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in t...

My Databook - diary.php?year Cross-Site Scripting

My Databook - diary.php?year Cross-Site Scripting source: https://www.securityfocus.com/bid/24311/info My DataBook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based...

My Databook - 'diary.php?delete' SQL Injection

source: https://www.securityfocus.com/bid/24311/info My DataBook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

Jetbox CMS 2.1 - Multiple SQL Injections

Jetbox CMS 2.1 - Multiple SQL Injections source: https://www.securityfocus.com/bid/24077/info Jetbox is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...