CVE-2006-1700

Summary: CVE-2006-1700 concerns Buy.php in Aweb Scripts Seller, where authentication relies on cookies that are predictable based on the current time and the script number, enabling remote attackers to bypass authentication. What is affected: The Aweb Scripts Seller product’s Buy.php authenticati...

CVE-2006-1700

Buy.php in Aweb Scripts Seller uses predictable cookies for authentication based on the time and the script number, which allows remote attackers to bypass authentication...

Microsoft Internet Explorer Popup Cross-Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain. Attackers could exploit this issue to gain access to sensitive information that is...

phpBB <= 2.0.19 (user_sig_bbcode_uid) Remote Code Execution Exploit

Exploit for unknown platform in category web applications =================================================================== phpBB new or die; $cookiejar = HTTP::Cookies-new; $xpl-cookiejar $cookiejar ; $xpl-proxy'http'='http://'.$proxy if $proxy; $ids = 'IDS:r57 phpBB2 exploit...

Crafty Syntax Image Gallery &lt;= 3.1g Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This...

Land Down Under <= 800 Multiple Vulnerabilities

The remote web server contains a PHP script that permits SQL injection and cross-site scripting attacks. Description : The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magicquotes' setting is disabled due to its failure to...

Land Down Under <= 801 Multiple Vulnerabilities

Land Down Under is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2006 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Pubcookie application server modules contain cross-site scripting vulnerabilities

Overview Cross-site scripting vulnerabilities in the Pubcookie application server modules could allow a remote attacker to gain access to sensitive information. Description Pubcookie is a software package that provides intra-institutional single-sign-on authentication for end-users over the web...

CVE-2006-1288

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

Sql injection

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

CVE-2006-1287

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer...

CVE-2006-1288

Multiple SQL injection vulnerabilities in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to 1 arrays of id/stamp pairs and 2 the keys in arrays of key/value pairs in ipsclass.php; 3 the topics variable in...

CVE-2006-1287

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer...

CVE-2006-1288

CVE-2006-1288 affects Invision Power Board (IPB) with versions 2.0.4 and 2.1.4 before 20060105. The vulnerability is a SQL injection in multiple entry points where cookies and parameters are not properly sanitized, including ipsclass.php (arrays of id/stamp pairs; keys in key/value arrays), userc...

php iCalendar <= 2.21 (Cookie) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================================ php iCalendar arbitrary local inclusion through cookies\r\n"; echo "by rgod rgodautisticiorg\r\n"; short explaination: phpICal stores language & template user preferences inside...

SquirrelMail strings.php base_uri Parameter Information Disclosure

The version of SquirrelMail installed on the remote host fails to check the origin of the 'baseuri' parameter in the 'functions/strings.php' script before using it to set the path for its cookies. An attacker may be able to leverage this issue to steal cookies associated with the affected...

mod_pubcookie -- cross site scripting vulnerability

Nathan Dors of the Pubcookie Project reports: Non-persistent XSS vulnerabilities were found in the Pubcookie Apache module modpubcookie and ISAPI filter. These components mishandle untrusted data when printing responses to the browser. This makes them vulnerable to carefully crafted requests...

pubcookie-login-server -- cross site scripting vulnerability

Nathan Dors of the Pubcookie Project reports: Multiple non-persistent XSS vulnerabilities were found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to...

vuBB 0.2 Final - cookie SQL Injection

vuBB 0.2 Final - cookie SQL Injection !/usr/bin/perl print q ---------------------------------------------------------------------- vuBB agent"Mosiac 1.0" . $ua-agent; if !$ARGV0 $ARGV0 = ''; if !$ARGV1 $ARGV1 = '1'; my $path = $ARGV0 . '/index.php'; my $user = $ARGV1; userid to jack my $uname =...

Information disclosure

Melange Chat Server aka M-Chat, when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive...