CVE-2008-6357

CVE-2008-6357 affects MyCal Personal Events Calendar. The vulnerability arises from storing the database (mycal.mdb) under the web root with insufficient access control, enabling remote attackers to download the database containing usernames and passwords via a direct request. The NVD entry lists...

CVE-2008-6355

The CVE-2008-6355 entry concerns Net Guys ASPired2Protect where sensitive data is stored under the web root with insufficient access control, allowing remote attackers to directly download ASPired2Protect.mdb containing usernames and passwords. The connected records confirm the affected product a...

Ewebeditor2.8.0最终版删除任意文件漏洞

eWebEditor是基于浏览器的、所见即所得的在线HTML编辑器。她能够在网页上实现许多桌面编辑软件（如：Word）所具有的强大可视编辑功能。WEB开发人员可以用她把传统的多行文本输入框TEXTAREA替换为可视化的富文本输入框，使最终用户可以可视化的发布HTML格式的网页内容。eWebEditor!已基本成为网站内容管理发布的必备工具！ 此漏洞存在于Example\NewsSystem目录下的delete.asp文件中，这是ewebeditor的测试页面，无须登陆可以直接进入，看这些代码： ‘ 把带”|”的字符串转为数组 Dim aSavePathFileName...

CVE-2009-0498

CVE-2009-0498 affects Virtual GuestBook (vgbook) 2.1. The data store is placed under the web root with insufficient access control, permitting remote attackers to directly download the database file (guestbook.mdb). This is a file-read access issue driven by improper access restrictions on web-ac...

Synactic ALL_IN_THE_BOX File Overwrite

DSECRG-09-006 Synactis AllINTHEBOX ActiveX Control - Null byte File Owervrite Synactis AllINTHEBOX ActiveX Control ALLINTHEBOX.OCX can be used to owervrite any any file in target system. Vulnerable method is "SaveDoc" Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL:...

Pixie CMS 1.0 - Multiple Local File Inclusions

Pixie CMS 1.0 - Multiple Local File Inclusions Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solutio...

Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities =========================================================== Digital Security Research Group DSecRG Advisory DSECRG-09-0...

CVE-2009-0249

The CVE-2009-0249 entry concerns Katy Whitton RankEm, where sensitive information is stored under the web root with insufficient access control. A remote attacker can directly request database/topsites.mdb and obtain a credentials-containing database. The underlying issue is improper access contr...

CVE-2008-5932

The CVE refers to CodeAvalanche FreeForum with an improper access control flaw that exposes the web root _private/CAForum.mdb, allowing remote attackers to download the database file containing passwords. The affected component is the forum software; the underlying cause is insufficient access co...

CVE-2008-5925

ASP-Dev XM Events Diary has a partial-access control weakness that exposes the diary.mdb database under the web root, allowing remote retrieval via a direct request. Affected component is the diary database/file handling within the web app; underlying issue is insufficient access control leading ...

Active Bids

--------------------------------------------------------- Portal Name: Active Bids Vendor : http://www.activewebsoftwares.com/P84ActiveBids.aspx?Tabopen=1 Author : PouyaServer , [email protected] Aria-Security.Net Vulnerability : SQL/XSS...

Blog Manager - 'ItemID' SQL Injection

source: https://www.securityfocus.com/bid/33314/info DMXReady Blog Manager is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal...

Digital Security Research Group [DSecRG] Advisory #DSECRG-09-003

Digital Security Research Group DSecRG Advisory DSECRG-09-003 Application: Oracle database 11G Versions Affected: Oracle 11.1.0.6 and 10.2.0.1 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 17.11.2008 Vendor response: 18.11.2008 Last response: 24.11.2008 Date of...

Establish a remote connection for the root user-bug warning-the black bar safety net

The following statement has the ROOT user the same permissions. Everyone in the holding station should come across. the root user of mysql, you can only locally connected, the external refuse the connection. The following methods can help you solve this problem, the following statements function...

CVE-2008-5885

The CVE-2008-5885 entry concerns Net Guys ASPired2Quote, where sensitive data is stored under the web root with insufficient access control. A remote attacker can directly request admin/quote.mdb and download the database file containing usernames and passwords, exposing partial confidentiality. ...

CVE-2008-5900

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, enabling remote attackers to download the database file CAArticles.mdb via a direct request to _private/CAArticles.mdb. Affected component: the web-accessible data store of CodeAvalanche Artic...

CVE-2008-5847

CVE-2008-5847 affects Constructr CMS up to version 3.02.5, where passwords are stored in cleartext in a MySQL database. The underlying issue is insecure password storage (cleartext in the hash column), enabling context-dependent attackers to read sensitive password information from the database. ...

CVE-2008-5597

CVE-2008-5597 affects Cold BBS, where sensitive data is stored under the web root with insufficient access control. The vulnerability allows remote attackers to directly download the database file (db/cforum.mdb), exposing stored information. The available sources describe the issue and confirm t...

CVE-2008-5572

CVE-2008-5572 pertains to Professional Download Assistant 0.1, where sensitive data is stored under the web root with insufficient access control. The description states that an attacker can download the database file (database/downloads.mdb) via a direct request, indicating exposure of stored da...

Live Chat Component for Joomla! 'last' Parameter Multiple SQLi

The version of the Live Chat component for Joomla! running on the remote host is affected by multiple SQL injection vulnerabilities in getChat.php and getSavedChatRooms.php due to improper sanitization of user-supplied input to the 'last' parameter before using it to construct database queries...