[ECHO_ADV_31$2006] Sws Web Server 0.1.7 Strcpy() & Syslog() Format String Vulnerability

--------------------------------------------------------------------------------------- ECHOADV31$2006 Sws Web Server 0.1.7 Strcpy & Syslog Format String Vulnerability --------------------------------------------------------------------------------------- Author : Dedi Dwianto Date : April, 28th...

CVE-2006-0388

CVE-2006-0388 affects Safari in Mac OS X 10.3 (before 10.3.9) and 10.4 (before 10.4.5). The underlying issue allows remote attackers to use HTTP redirection to local resources to redirect users and execute arbitrary JavaScript. The connected documents confirm the affected family and behavior but ...

Dragonfly CMS 9.0.6.1 Stories_Archive Module - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/16784/info Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in...

CVE-2006-0651

SQL injection vulnerability in index.php in vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition Page...

XSS in WBNews < = v1.1.0

it is possible to be executed I cosay arbitrary within the system wbnews in the field "Name" for example scriptalert"Hello DragoN";/script WBNews http://www.webmobo.com/ DragoN [email protected]...

USN-229-1: Zope vulnerability

Zope did not deactivate the file inclusion feature when exposing RestructuredText functionalities to untrusted users. A remote user with the privilege of editing Zope webpages with RestructuredText could exploit this to expose arbitrary files that can be read with the privileges of the Zope serve...

CVE-2005-4159

The CVE concerns Simple Machines Forum (SMF) prior to 1.1 rc1 (inclusive) with a potential SQL injection in Memberlist.php via the start parameter. The vendor disputes that it constitutes a true SQL injection, arguing only a single character can be modified, which may be an invalid SQL syntax err...

Tiki Wiki CMS Groupware Multiple Unspecified Remote Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

flexbackup default config insecure temporary file creation

flexbackup default config insecure temporary file creation Vendor: http://flexbackup.sourceforge.net/ Advisory: http://www.zataz.net/adviso/flexbackup-09192005.txt Vendor informed: yes Exploit available: yes Impact : low Exploitation : low The vulnerabilities ared due to insecure temporary files...

CVE-2005-3236

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via 1 the fid parameter of newmsg.php, which can enable XSS attacks when the SQL syntax is invalid or 2 the nick parameter of lostpwd.php...

CVE-2005-2778

SQL injection vulnerability in member.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL statements via the fid parameter...

[Full-disclosure] [ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC

Gentoo Linux Security Advisory GLSA 200507-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

phpBB < 2.0.16 viewtopic.php Highlighting Feature Arbitrary PHP Code Execution

The remote host is running a version of phpBB that allows attackers to inject arbitrary PHP code to the 'viewtopic.php' script to be executed subject to the privileges of the web server userid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Ovidentia FX - Remote File Inclusion

Ovidentia FX - Remote File Inclusion source: https://www.securityfocus.com/bid/13927/info Ovidentia FX is prone to a remote file include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server...

Warrior Kings 1.3 And Warrior Kings: Battles 1.23 - Remote Format String

Warrior Kings 1.3 And Warrior Kings: Battles 1.23 - Remote Format String source: https://www.securityfocus.com/bid/13711/info Warrior Kings, and Warrior Kings: Battles are vulnerable to a remote format string vulnerability. This issue is due to a failure of the application to securely implement a...

CVE-2005-1512

CVE-2005-1512 concerns the Admin panel of PwsPHP 1.2.2 , where the upload validation for image files is inadequate. The vulnerability allows remote attackers to upload potentially arbitrary files, which could lead to arbitrary code execution on the server. The CVSS details from the entry indicate...

CVE-2005-0125

The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to 1 delete arbitrary files via atrm, 2 execute arbitrary programs via the -f argument to batch, or 3 read arbitrary files via the -f argument to batch, which generates a job file that is...

CVE-2005-0726

SQL injection vulnerability in editpost.php in UBB.threads 6.0 allows remote attackers to execute arbitrary SQL commands via the Number parameter...

CVE-2005-0268

CVE-2005-0268 affects FlatNuke 2.5.1 and describes a Direct code injection vulnerability that allows an attacker to execute arbitrary PHP code by placing the payload in the url_avatar field. The connected documents corroborate a remote code execution risk in FlatNuke via a form submission field, ...

Debian DSA-158-1 : gaim - arbitrary program execution

The developers of Gaim, an instant messenger client that combines several different networks, found a vulnerability in the hyperlink handling code. The 'Manual' browser command passes an untrusted string to the shell without escaping or reliable quoting, permitting an attacker to execute arbitrar...