Joomla 1.5.26 ja_purity Cross Site Scripting

waraxe-2012-SA087 - Reflected XSS in Joomla 1.5.26 "japurity" template =============================================================================== Author: Janek Vind "waraxe" Date: 03. May 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-87.html CVE:...

Elcom CommunityManager.NET - Authentication Bypass

Elcom CommunityManager.NET - Authentication Bypass Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004 Release Date. 20-Dec-2010 Last Update. - Vendor Notification Date. 22-Jan-2010 Product. Elcom Technology's CommunityManager.NET Platform. IIS with ASP.NET...

Directory traversal

Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the 1 cooklan cookie parameter $landir variable or possibly 2 Sdbtype parameter. NOTE: this was originally reported as remote file...

Authentication flaw

Optimum Web Design Tutorial Share 3.5.0 and earlier allows remote attackers to bypass authentication and obtain administrative access by setting the usernamed cookie parameter...

Authentication flaw

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter...

glFusion lib-session.php模块SQL注入漏洞

BUGTRAQ ID: 34361 CVECAN ID: CVE-2009-1282,CVE-2009-1283 glFusion是一个开源的内容管理系统。 glFusion的private/system/lib-session.php模块没有正确地过滤用户所提交的glfsession cookie参数，远程攻击者可以通过向服务器提交恶意请求执行SQL注入攻击。以下是/private/system/lib-session.php 的97-117行的有漏洞代码段： ... if isset $COOKIE$CONF'cookiesession' $sessid = COMapplyFilt...

CVE-2009-1282

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glfsession cookie parameter...

Sql injection

SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter...

Authentication flaw

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter...

CVE-2008-6581

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter...

CVE-2009-1229

SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter...

CVE-2009-1229

SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter...

CVE-2008-6581

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter...

Sql injection

SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the newsuser cookie parameter...

CVE-2008-6517

SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the newsuser cookie parameter...

CVE-2008-6517

SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the newsuser cookie parameter...

CVE-2009-0883

SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMSlogin cookie parameter...

Sql injection

SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMSlogin cookie parameter...

Sql injection

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...

Directory traversal

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. dot dot in the user cookie parameter...