357 matches found
PT-2012-2046
Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! version 3.65 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of users for requests, including...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...
CVE-2011-5029
Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...
CVE-2011-5029: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...
PT-2011-5176
Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions 0.7.0 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities...
CVE-2011-3371
Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...
CVE-2011-3371
Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...
CVE-2011-3371: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...
PT-2011-4411
Name of the Vulnerable Software and Affected Versions PunBB versions prior to 1.3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files, including delete.php, edit.php, login.php, misc.php, profile.php, and register.ph...
CVE-2010-0989
Pulse CMS contains a directory traversal vulnerability in delete.php (f parameter) affecting versions prior to 1.2.3. Exploitation allows remote authenticated users to delete arbitrary files on the server via directory traversal sequences. Severity is evidenced as moderately critical in Secunia’s...
CVE-2010-0989
Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter...
CVE-2010-0989: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter...
CVE-2008-7181: Undefined Security Weakness
Butterfly Organizer 2.0.0 allows remote attackers to 1 delete arbitrary categories via a modified tablehere parameter to category-delete.php with the isjsconfirmed parameter set to 1, or 2 delete arbitrary accounts via the mytable parameter to delete.php...
CVE-2009-2608: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to delete.php or 2 alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565...
Podcast Generator 1.2 Re-Installation
$file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1. blocks all 'amilogged' REQUEST variables,what about GLOBALS?,therefore useless! 2. if 'amilogged' isn't true - exit function activated. 3. unlink...
Podcast Generator 1.2 - Unauthorized Re-Installation
$file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1. blocks all 'amilogged' REQUEST variables,what about GLOBALS?,therefore useless! 2. if 'amilogged' isn't true - exit function activated. 3. unlink...
Podcast Generator <= 1.2 unauthorized Re-Installation Remote Exploit
Exploit for unknown platform in category web applications ==================================================================== Podcast Generator $file.$ext $Ldeleted"; / Explanation code snippet above points ----------------------------------------------------------------------------------- 1...
CVE-2008-6743: Improper Authentication
RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to 1 delete.php, 2 edit-submit.php, 3 edit.php, 4 submit.php, and 5 update.php, which bypasses the security check...
CVE-2009-1226: Undefined Security Weakness
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter...