Unfixed XSS vulnerability at www.ddruk.com

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.ddruk.com, which at the time of submission ranked 162510 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/03/2007. It is currently...

Unfixed XSS vulnerability at www.warez-downloads.net

Security researcher flux, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting www.warez-downloads.net, which at the time of submission ranked 85177 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

neuron news 1.0 (index.php q) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================ neuron news 1.0 index.php q Local File Inclusion Vulnerability ================================================================ \|/// \ - - // Y! Underground Group @ @...

SOL7854 - Web Applications Content Processing Scripts vulnerability

F5 Product Development tracked this issue as CR81839 and it was fixed in FirePass 6.0.2. For information about upgrading, refer to the FirePass release notes. Additionally, cumulative hotfix HF-552-10 has been issued for FirePass 5.5.2, cumulative hotfix HF-600-15 has been issued for FirePass 6.0...

NMDeluxe 2.0.0 - id SQL Injection

NMDeluxe 2.0.0 - id SQL Injection not sec group http://www.notsec.com [email protected] NMDeluxe 2.0.0 Class: SQL Injection Found: 30/08/2007 Remote: Yes Site: http://www.wsdeluxe.com/nmdeluxe/ Download: http://downloads.sourceforge.net/nmdeluxe/nmdeluxe2.0.0.zip?modtime=1178396844&bigmirror=0...

Unfixed XSS vulnerability at www.xpmediacentre.com.au

Security researcher st@rext, has submitted on 08/10/2007 a cross-site-scripting XSS vulnerability affecting www.xpmediacentre.com.au, which at the time of submission ranked 135307 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/10/2007. It i...

CVE-2007-3985

The CVE-2007-3985 issue affects Secure Computing SecurityReporter (aka Network Security Analyzer) version 4.6.3, where the file.cgi script fails to sanitize the name parameter. This enables a directory traversal attack (".." in the name) allowing remote attackers to download arbitrary files from ...

CVE-2007-3814

Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via 1 the idurlo field in the deleteurlo function in a index.php in the urlobox module; the iden field in the 2 updatefile and 3 delfile functions in b index.php in the reviews module...

CVE-2007-3814

CVE-2007-3814 documents multiple SQL injection vulnerabilities in MKPortal 1.1.1 that allow remote attackers to execute arbitrary SQL commands through numerous parameters in index.php across several modules (urlobox, reviews, news, gallery, downloads), including idurlo, iden, idnews, idcomm, ide,...

MkPortal - Multiple SQL Injection Vulnerabilities

We tried very hard to find wslabis mkportal SQL Injection but after ten minutes of "research" we decided that it is hopeless to find exactly the same bug and therefore we release a compilation of mkportal sql injections for the interested reader. Some of them are junk because you need a moderator...

SOL7397 - Download of local FirePass files using the URL in Webtop or the Admin UI

A vulnerability exists that allows an authenticated FirePass user to download files from the filesystem of a FirePass controller. In order to download a file, the user must first log in to the FirePass controller webtop or the Admin UI, and type a specially crafted URL into their web browser. Thi...

Unfixed XSS vulnerability at www.unlimitedgamedownloads.com

Security researcher By Encore, has submitted on 05/04/2007 a cross-site-scripting XSS vulnerability affecting www.unlimitedgamedownloads.com, which at the time of submission ranked 48153 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/04/200...

Sql injection

SQL injection vulnerability in visit.php in the Rha7 Downloads rha7downloads 1.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-1960. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-2107

SQL injection vulnerability in visit.php in the Rha7 Downloads rha7downloads 1.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-1960. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-2107

SQL injection vulnerability in visit.php in the Rha7 Downloads rha7downloads 1.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-1960. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-2107

CVE-2007-2107 describes an SQL injection in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, triggered via the cid parameter in visit.php. The vulnerability arises from processing user-supplied input without proper sanitization, allowing remote attackers to potentially modify or exfiltrat...

XOOPS Rha7 Downloads Module Visit.PHP SQL注入漏洞

XOOPS Rha7 Downloads是一款基于PHP的WEB应用程序。 XOOPS Rha7 Downloads不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'Visit.PHP'脚本对用户提交的'postid'参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 Xoops Rha7 Downloads Module 1.0 目前没有解决方案提供： http://www.xoops.org/ !/usr/bin/perl Script Name: XOOPS Module Rha7 Downloads...

CVE-2007-1960

SQL injection vulnerability in visit.php in the Rha7 Downloads rha7downloads 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter...

CVE-2007-1960

SQL injection vulnerability in visit.php in the Rha7 Downloads rha7downloads 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter...

CVE-2007-1960

The CVE-2007-1960 entry describes an SQL injection in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS (and possibly versions up to 1.10). The vulnerability occurs in visit.php via the lid parameter, allowing remote attackers to execute arbitrary SQL commands. The available connected docum...