3471 matches found
itcms-exec.txt
=========================================================================================================================== | | / | | | | | | | / / / || \ '| / | ' / - | / \ V V / - ' \ / - || | \/,|/| /| |||||///|./ |,|...
Microsoft Security Bulletin MS08-021 – Critical Vulnerabilities in GDI Could Allow Remote Code Execution (948590)
Microsoft Security Bulletin MS08-021 – Critical Vulnerabilities in GDI Could Allow Remote Code Execution 948590 Published: April 8, 2008 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in GDI. Exploitation of either of these...
Cacti 0.8.7 - 'graph_view.php?graph_list' SQL Injection
source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP response-splitting vulnerability. Attackers may exploit these...
[SA27699] Layton HelpBox Multiple Vulnerabilities
---------------------------------------------------------------------- A new version 0.9.0.0 - Release Candidate 1 of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today:...
Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities
Background Mozilla Firefox is a cross-platform web browser from Mozilla. SeaMonkey is a free, cross-platform Internet suite. Description Multiple vulnerabilities have been reported in Mozilla Firefox and SeaMonkey. Various errors in the browser engine and the Javascript engine can be exploited to...
CVE-2002-2303
3D3.Com ShopFactory 5.8 is affected by a vulnerability where client-side encryption and decryption of sensitive price data enables remote attackers to modify shopping cart prices by using JavaScript to decrypt the cookie containing the data. This indicates a weakness in where price data is stored...
Scott Manktelow Design Stride 1.0 - Content Management System main.php SQL Injection
Scott Manktelow Design Stride 1.0 - Content Management System main.php SQL Injection source: https://www.securityfocus.com/bid/26041/info Scott Manktelow Design Stride 1.0 Content Management System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied...
Oracle Security: Insert / Update / Delete Data via Views
Insert / Update / Delete Data via Views This advisory http://www.red-database-security.com/advisory/oracleviewvulnerability.html Name Insert / Update / Delete Data via Views DB17 Systems Oracle 8i - 10g Rel. 2 Severity High Risk Category Bypass Access Control Author Alexander Kornbrust ak at...
POWER PHLOGGER v.2.2.5 (username) SQL Injection
POWER PHLOGGER v.2.2.5 username SQL Injection Author: Attila Gerendi Darkz Date: December 20, 2005 Package: POWER PHLOGGER http://www.phpee.com/ Versions Affected: v.2.2.5 Other versions may also be affected Severity: SQL Injection Description: Input passed to the "username" parameter in...
fusetalkpoc-sql.txt
Hello everyone, After trying to report bugs to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure Policy v2.0, we...
fusetalk SQL (autherror.cfm)
Hello everyone, After trying to report bugs to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure Policy v2.0, we...
AP Newspower software <=4.0.1 allows remote data manipulation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AP Newspower is commercial software available from the AP that allows media outlets to obtain text news feeds from the Associated Press. It's like RSS, but you pay for it. And it's slower. And fatter. The default install of this software includes a...
Nuked-klaN 1.7.6 - Remote Code Execution
Nuked-klaN 1.7.6 - Remote Code Execution Website: http://www.acid-root.new.fr/ PHP conditions: None = Private since 2 months. errorreportingEALL ^ ENOTICE; This file require the PhpSploit class. $xpl = new phpsploit; $url = 'http://localhost/nk/'; url $prx = ''; proxy : $pra = ''; basic...
dxbbs注入漏洞
在UserFriend.aspx过滤了=Add&Name=admin加上'' 典型的过滤不严,导致注入漏洞. dxbbs 7.3 http://www.dxbbs.cn/ http://www.winshell.cn/read.php?508 SQL版测试方法: serFriend.aspx过滤了=Add&Name=大蝉;Update Dxbbsuser set userpass=''7a57a5a743894a0e'' where username=''admin'';--...
CVE-2007-0601
common/safety.php in Aztek Forum 4.00 allows remote attackers to enter certain data containing %22 sequences URL encoded double quotes and other potentially dangerous manipulations by sending a cookie, which bypasses the blacklist matching against the GET and PUT superglobal arrays...
[SA23887] Drupal Project Issue Tracking Module Multiple Vulnerabilities
TITLE: Drupal Project Issue Tracking Module Multiple Vulnerabilities SECUNIA ADVISORY ID: SA23887 VERIFY ADVISORY: http://secunia.com/advisories/23887/ CRITICAL: Less critical IMPACT: Security Bypass, Cross Site Scripting, Manipulation of data, Exposure of sensitive information, System access...
NCTsoft NCTAudioFile2 ActiveX Control Remote Buffer Overflow Vulnerability
Description NCTsoft NCTAudioFile2 ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer. NCTAudioEditor is a collection of ActiveX controls for...
[SA23895] Drupal Acidfree Module "node titles" SQL Injection Vulnerability
TITLE: Drupal Acidfree Module "node titles" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA23895 VERIFY ADVISORY: http://secunia.com/advisories/23895/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Drupal Acidfree Module 4.x http://secunia.com/product/13326/...
[SA23726] All In One Control Panel "download_category" SQL Injection
TITLE: All In One Control Panel "downloadcategory" SQL Injection SECUNIA ADVISORY ID: SA23726 VERIFY ADVISORY: http://secunia.com/advisories/23726/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: All In One Control Panel 1.x http://secunia.com/product/12505...