PostNuke Members_List Module Information Disclosure

The remote host is running PostNuke. It is possible to use the CMS to determine the full path to its installation on the server or the name of the database used, by doing a request like : /modules.php?op=modload&name=MembersList&file=index&letter=All&sortby=foobar An attacker may use these flaws ...

SimpleBBS 1.0.6 Default Permissions Vuln

SimpleBBS 1.0.6 Security Problem: User database stored in a php file that's readable by anyone. http://www.tareget.com/simplebbs/users/users.php Passwords are md5'ed, but user data is not. The vendor was notified and has released updates. FluRDoInG [email protected] http://www.flurnet.org KEY ID...

Code Injection in phpBB Advanced Quick Reply Mod

Software: phpBB Advanced Quick Reply Mod I've found a security hole in this sofware Code Injection. You can download this software at http://phpbbhacks.com/viewhack.php?id=586 Hackers can exploit this Mod to inject some shell code to hack your forum, your website or your server local exploit...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities

source: https://www.securityfocus.com/bid/4957/info It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute script code within the context of the site as an authenticated...

Possible Issue with Netinfo and Mac OS X

Hi, I have been using Mac OS X for quite a while now, and I have just found something that concerns me a little. As you probably know Mac OS X is based on BSD and by default does not have any services running though it is not hard to turn these on thefore is reasonably secure out of the box. Now ...

extent technologies rbs isp 2.5 - Directory Traversal

extent technologies rbs isp 2.5 - Directory Traversal source: https://www.securityfocus.com/bid/1704/info A remote user is capable of gaining read access to any file residing in the same directory of a host running Extent RBS ISP through directory traversal. Appending '../' to the 'image' variabl...

SRADV00001.txt

================================================= Secure Reality Pty Ltd. Security Advisory 1 SRADV00001 http://www.securereality.com.au ================================================= Title Arbitrary file disclosure through PHP file upload Released 04/09/2000 We found this particular issue a...

Dansie Shopping Cart 3.0.4 - Multiple Vulnerabilities

Dansie Shopping Cart 3.0.4 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/1115/info Appending specific variables and values to http://target/cgi-bin/cart.pl? will allow remote users to perform certain actions. "vars" will display the configuration settings of the application...

Dansie Shopping Cart 3.0.4 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/1115/info Appending specific variables and values to http://target/cgi-bin/cart.pl? will allow remote users to perform certain actions. "vars" will display the configuration settings of the application, which includes the username and password used for...

ms.siteserver.3.0.adsamples.txt

Date: Tue, 11 May 1999 16:27:38 -0600 From: Mark To: [email protected] Subject: ALERT Site Server 3.0 May Expose SQL IDs and PSWs ==================================================== Site Server's AdSamples Directory Reveals ID and PSW Discovered by Andrey Kruchkov...