8577 matches found
FreeWebshop.org Script <= 2.2.2 Multiple Remote Vulnerabilities
Product: www.freewebshop.org Version: 2.2.x, maybe lower Critical Lvl : Highly critical Where : From Remote Exploits: Bypass Login: username:admin password:' or 'a'='a Read Files: /index.php?page=info&action=../../../../../../../../../../../../etc/passwd00 List Passwords:...
FreeWebshop.org Script <= 2.2.2 Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications =============================================================== FreeWebshop.org Script = 2.2.2 Multiple Remote Vulnerabilities =============================================================== Product: www.freewebshop.org Version: 2.2.x, may...
FreeWebshop.org Script <= 2.2.2 Multiple Remote Vulnerabilities
No description provided by source. Product: www.freewebshop.org Version: 2.2.x, maybe lower Critical Lvl : Highly critical Where : From Remote Exploits: Bypass Login: username:admin password:' or 'a'='a Read Files: /index.php?page=info&action=../../../../../../../../../../../../etc/passwd%00 List...
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities Product: www.freewebshop.org Version: 2.2.x, maybe lower Critical Lvl : Highly critical Where : From Remote Exploits: Bypass Login: username:admin password:' or 'a'='a Read Files:...
Mozilla Firefox Range脚本对象拒绝服务漏洞
Firefox是一款开放源码的WEB浏览器。 Firefox的Range对象中存在空指针引用问题，成功利用这个漏洞的攻击者可以导致浏览器崩溃。 可以使用selectNode方式初始化Range对象选择将要注入Range中的节点，也可以使用createContextualFragment方式创建文档碎片，如下所示： var tagString = "divI am a div node/div"; var range = document.createRange; range.selectNodedocument.getElementsByTagName"div".item0; var...
HostingController6.1.txt
Hosting Controller 'EnableForum.asp' and 'DisableForum.asp' Scripts Let Remote Users Create or Delete Forums and Virtual Directories advisory : http://www.kapda.ir/advisory-442.html http://securitytracker.com/alerts/2006/Oct/1017103.html SQLInjection, Command Injection ------- KAPDA::59 - Hosting...
CVE-2006-5630: Undefined Security Weakness
Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to 1 delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and 2 create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum...
Hosting Controller 6.1 Hotfix <= 3.2 Vulnerability
Hosting Controller 'EnableForum.asp' and 'DisableForum.asp' Scripts Let Remote Users Create or Delete Forums and Virtual Directories advisory : http://www.kapda.ir/advisory-442.html http://securitytracker.com/alerts/2006/Oct/1017103.html...
CVE-2006-5455: Undefined Security Weakness
Cross-site request forgery CSRF vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL...
CVE-2006-5333: Undefined Security Weakness
Unspecified vulnerability in Oracle Spatial component in Oracle Database 10.2.0.2 has unknown impact and remote authenticated attack vectors related to "create session" privileges, aka Vuln DB02. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB02 is for SQ...
DEBIAN-CVE-2006-5297
Race condition in the safeopen function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the OEXCL flag on NFS filesystems...
Xcode OpenBase <= 9.1.5 (root file create) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom http://docs.info.apple.com/article.html?artnum=61798 This won't help ftp://www.openbase.com/pub/OpenBase10.0 This will Create a new file anywhere on the filesystem with...
Xcode OpenBase 9.1.5 (OSX) - Root File Create Privilege Escalation
Xcode OpenBase 9.1.5 OSX - Root File Create Privilege Escalation !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom http://docs.info.apple.com/article.html?artnum=61798 This won't help ftp://www.openbase.com/pub/OpenBase10.0 This will Create a new file...
Hastymail 1.x - IMAP SMTP Command Injection
Hastymail 1.x - IMAP SMTP Command Injection source: https://www.securityfocus.com/bid/20424/info Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An authenticated malicious user could execute arbitrary IMAP / SMTP...
Hastymail 1.x - IMAP SMTP Command Injection
source: https://www.securityfocus.com/bid/20424/info Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An authenticated malicious user could execute arbitrary IMAP / SMTP commands on the affected mail server...
CVE-2006-5122: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Mercury SiteScope 8.2 8.1.2.0 allow remote authenticated users to inject arbitrary web script or HTML via 1 "any field create name field" except "create new group name" or 2 any description field...
Blog Pixel Motion 2.1.1 - PHP Code Execution Create Admin
Blog Pixel Motion 2.1.1 - PHP Code Execution Create Admin !/usr/bin/perl Affected.scr..: Blog Pixel Motion V2.1.1 Poc.ID........: 12060927 Type..........: PHP Code Execution stripslashes, SQL Injection urldecode Risk.level....: High Vendor.Status.: Unpatched Src.download..:...
Blog Pixel Motion 2.1.1 - PHP Code Execution / Create Admin
!/usr/bin/perl Affected.scr..: Blog Pixel Motion V2.1.1 Poc.ID........: 12060927 Type..........: PHP Code Execution stripslashes, SQL Injection urldecode Risk.level....: High Vendor.Status.: Unpatched Src.download..: www.pixelmotion.org/zip/blog2.1.zip Poc.link......:...
Blog Pixel Motion 2.1.1 PHP Code Execution / Create Admin Exploit
No description provided by source. !/usr/bin/perl Affected.scr..: Blog Pixel Motion V2.1.1 Poc.ID........: 12060927 Type..........: PHP Code Execution stripslashes, SQL Injection urldecode Risk.level....: High Vendor.Status.: Unpatched Src.download..: www.pixelmotion.org/zip/blog2.1.zip...
CVE-2006-4360
Cross-site scripting XSS vulnerability in E-commerce 4.7 for Drupal before file.module 1.37.2.4 20060812 allows remote authenticated users with the "create products" permission to inject arbitrary web script or HTML via unspecified vectors...