CVE-2005-4400: Undefined Security Weakness

Cross-site scripting XSS vulnerability in downloads/portalent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 77strutsaction, 2 ppmode, and 3 ppstate parameters...

1-2-3 music store "AlbumID" Sql injection.

1-2-3 music store "AlbumID" Sql injection. Vuln. dicovered by : r0t Date 23 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/1-2-3-music-store-albumid-sql.html Vendor:http://easybe.com/ affected version: 1.0 and prior Product Description: Description: 1-2-3 Music Store - the music...

CVE-2005-3681

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

CVE-2005-3681

CVE-2005-3681 describes a SQL injection vulnerability in the XOOPS WF-Downloads module 2.05. The flaw affects the file viewcat.php where the list parameter can be exploited to execute arbitrary SQL commands. Based on the provided documents, the vulnerability is exploitable remotely (network vecto...

CVE-2005-3681

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

CVE-2005-3681: Undefined Security Weakness

SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter...

[[email protected]: Macromedia Security Bulletins]

Macromedia Security Bulletins: - Contribute Publishing Server - Flash Communication Server - Breeze Communication Server and Breeze Live Server MPSB05-08 Contribute Publishing Server Password Encryption Summary: Macromedia Contribute Publishing Server CPS 1.11 includes a security update that...

XOOPS 2.2.3 Final arbitrary local inclusion / XOOPS WF-Downloads module v 2.05 SQL Injection

11.04 12/11/2005 1XOOPS 2.2.3 Final arbitrary local inclusion 2XOOPS WF-Downloads module v 2.05 SQL Injection / Administrative credentials disclousre / Remote commands execution software: site: http://www.xoops.org/ description: "XOOPS is an extensible, OO Object Oriented, easy to use dynamic web...

CVE-2005-3304

Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via 1 the username parameter in the Your Account page, 2 the url parameter in the Downloads module, and 3 the description parameter in the WebLinks module...

PhpNuke 7.8 with all security fixes/patches "Your_Account", "Downloads", "Web Links" SQL Injection / Remote commans execution

PHPNuke 7.8 with all security fixes/patches "Downloads", "WebLinks" & "YourAccount" SQL INjection - remote commands execution poc exploit there are a lot of unsanitized vars in every module, as I can see, so if magicquotesgpc is Off - SQL INJECTION 1 you can go to "Your Account" and submit a...

PHP-Nuke 7.8 - SQL Injection / Remote Command Execution

?php 20.05 23/10/2005 ---phpnuke78xpl.php PHPNuke 7.8 with all security fixes/patches "Downloads","WebLinks" & "YourAccount" modules SQL Injection / remote commands execution exploit yet not tested 7.9, but OK... by rgod site: http://rgod.altervista.org make these changes in php.ini if you have...

CVE-2005-2885

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2885: Undefined Security Weakness

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...

CVE-2005-2690

SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php...

CVE-2005-2690: Undefined Security Weakness

SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php...

phpBB 2.0.16 released

Hi everyone, phpBB Group announces the release of phpBB 2.0.16. This release addresses some bugfixes and one critical security issue. To fix this, please apply the following change: In viewtopic.php Find: $message = strreplace'"', '"', substr@pregreplace'?^+|?Rse', "@pregreplace'b" . strreplace''...

CVE-2003-1210

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the 1 lid parameter to the getit function or the 2 min parameter to the search function...

CVE-2003-1210

The CVE-2003-1210 entry describes multiple SQL injection vulnerabilities in the PHP-Nuke Downloads module (versions 5.x through 6.5). The root cause is unsafely constructed SQL queries exposed via the lid parameter to getit and the min parameter to search, allowing remote attackers to execute arb...

CVE-2003-1210: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the 1 lid parameter to the getit function or the 2 min parameter to the search function...

CVE-2004-1957

Multiple XSS vulnerabilities affect PostNuke 0.726. Affected vectors include (1) lid and a query parameter to the Downloads module, (2) a query parameter to the Web_links module, and (3) the hlpfile parameter to openwindow.php, enabling remote attackers to inject arbitrary web script or HTML. The...