Code injection

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field aka Email text box. NOTE: the vendor disputes this, stating "I'm unable to...

CVE-2008-2478

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field aka Email text box. NOTE: the vendor disputes this, stating "I'm unable to...

CVE-2008-2478: Improper Control of Generation of Code

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field aka Email text box. NOTE: the vendor disputes this, stating "I'm unable to...

PT-2008-3935 · Cpanel · Cpanel

Name of the Vulnerable Software and Affected Versions: cPanel versions 11.18.6 and earlier, 11.23.1 and earlier Description: The issue allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field. The vendor disputes this...

Carbon Communities forum Multiple Vulnerabilities.

www.BugReport.ir AmnPardaz Security Research Team Title: Multiple Vulnerabilities in Carbon Communities forum. Vendor: www.carboncommunities.com Vulnerable Version: 2.4 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/35 1. Description:...

gallarific-xss.txt

Hello, I was looking at the free version of gallarific, and I found some suspicious code in the scopbin directory. Attached is a file I found in the zip i downloaded, in case someone wants to decode it. the package can be downloaded from http://www.gallarific.com/download.php Also, the software...

phpmyt-rfi.txt

Hello PHPMyTourney Remote file include Vulnerability Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] home page : http://phpmytourney.sourceforge.net Script : PHPMyTourney vulnerable file : phpmytourney/sources/tourney/index.p...

CVE-2007-6237: Improper Authentication

cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than...

Liferay Enterprise Portal multiple XSS

Vendor Site: Liferay.net Version affected: Liferay Enterprise Portal 4.3.1 Demo:http://www.liferay.net/c/portal/login?tabs1=forgot-password Class: Input Validation Error Overview: Liferay fails to sufficiently sanitize user-supplied input data in "email address" text box by pressing the "Send New...

liferay-xss.txt

Vendor Site: Liferay.net Version affected: Liferay Enterprise Portal 4.3.1 Demo:http://www.liferay.net/c/portal/login?tabs1=forgot-password Class: Input Validation Error Overview: Liferay fails to sufficiently sanitize user-supplied input data in "email address" text box by pressing the "Send New...

PHP-AGTC membership system 1.1a Remote Add Admin Exploit

No description provided by source. !-- - Product : AGTC-Membership system - Version : 1.1a - Website : http://www.agtc.co.uk - Author : 0x90 - Homepage: WwW.0x90.CoM.Ar - Contact : Gunsat0x90dotcomdotar - Problem : Admin Added Access. -- form name="form1" method="post"...

CVE-2007-5704: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL commands via the 1 Email Address and 2 Password fields in a login.asp and b adminlogin.asp...

HP Linux Imaging and Printing Project (hplip) hpssd from Address Command Injection

The version of the HP Linux Imaging and Printing System hpssd daemon on the remote host fails to sanitize user-supplied input before appending it to a commandline when calling sendmail. Using a specially crafted email address, an unauthenticated, remote attacker can leverage this issue to execute...

TorrentTrader Classic 1.07 - Multiple Vulnerabilities

TorrentTrader Classic Mutiple Remote vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Tested on TorrentTrader Classic v1.07 local file inclusion backend/admin-functions.php?ssuri=dd Xss...

TorrentTrader Classic 1.07 - Multiple Vulnerabilities

TorrentTrader Classic 1.07 - Multiple Vulnerabilities TorrentTrader Classic Mutiple Remote vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Tested on TorrentTrader Classic v1.07 local file inclusion...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LetterGrade allow remote attackers to inject arbitrary web script or HTML via 1 a student's email address, 2 the year parameter to genbrws/Student/calmonth.php3, and other unspecified vectors related to the calendar. NOTE: the provenance of thi...

CVE-2007-4945

Multiple cross-site scripting XSS vulnerabilities in LetterGrade allow remote attackers to inject arbitrary web script or HTML via 1 a student's email address, 2 the year parameter to genbrws/Student/calmonth.php3, and other unspecified vectors related to the calendar. NOTE: the provenance of thi...

Joomla multiple vulerabilities

Hello Joomla multiple vulerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Affected Versions 1.0.X - tested on 1.0.12 and 1.5 maybe affected - not tested but probebly affected sql injection...

Buffer overflow

Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry. NOTE: this might overlap CVE-2007-3638...

CVE-2007-3928

Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry. NOTE: this might overlap CVE-2007-3638...