2829 matches found
CVE-2006-2501
Cross-site scripting XSS vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and...
SAP Web Application Server crossite scripting
Crossite scripting with error messages...
Path traversal
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
DSA-1056-1 webcalendar - verbose error message
Bulletin has no description...
[Full-disclosure] WebCalendar User Account Enumeration Weakness
WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. See project homepage for details: http://www.k5n.us/webcalendar.php Description: The problem is that different...
struts LookupDispatchAction XSS
Cross-site scripting XSS vulnerability in 1 LookupDispatchAction and possibly 2 DispatchAction and 3 ActionDispatcher in Apache Software Foundation ASF Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting...
MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities
Secunia reports: MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system. 1 An error within the code that generates an error response to an invalid COMTABLEDUMP packet can be exploited by an...
CVE-2006-2047
Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...
Sql injection
Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...
CVE-2006-2047
The CVE-2006-2047 entry affects Application Dynamics Cartweaver ColdFusion versions 2.16.11 and earlier. The vulnerability arises via invalid input parameters in Results.cfm (secondary, PageNum_Results, category, keywords) and Details.cfm (ProdID), which can cause error messages that disclose int...
CVE-2006-2047
Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...
security flaw
Multiple cross-site scripting XSS vulnerabilities in PHP 4.4.1 and 5.1.1, when displayerrors and htmlerrors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message...
Design/Logic Flaw
Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...
Full path disclosure in Webcalendar 1.1.0-CVS
Full path disclosure in webcalendar Author : Rusydi Hasan M a.k.a : cR45H3R Location : Indonesia, Cilacap Date : March,28th 2006 Version : 1.1.0-CVS --- software description WebCalendar is a PHP application used to maintain a calendar for one or more persons and for a variety of purposes. ---...
Vavoom 1.19.1 - Multiple Vulnerabilities/Denial of Service
/ by Luigi Auriemma / include include include include include ifdef WIN32 include / Header file used for manage errors in Windows It support socket and errno too this header replace the previous sockerrX.h / include include void stderrvoid char error; switchWSAGetLastError case 10004: error =...
Directory traversal
Directory traversal vulnerability in Baby FTP Server BabyFTP 1.24 allows remote authenticated users to determine existence of files outside the intended document root via unspecified manipulations, which generate different error messages depending on whether a file exists or not...
BomberClone < 0.11.6.2 - Error Messages Remote Buffer Overflow
/ bomberclone include include include include include include include / fork + bind port 31337 - ty izik / char linuxshellcode= "\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02\x89\xe1\xcd\x80" "\x5b\x5d\x52\x66\xbd\x69\x7a\x0f\xcd\x09\xdd\x55\x6a\x10\x51"...
SoftBB 0.1 - mail Blind SQL Injection
SoftBB 0.1 - mail Blind SQL Injection !/usr/bin/env python LOTFREE TEAM 03/2006 http://lotfree.next-touch.com/ http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py Vulnerability info Product : SoftBB Version : 0.1 The field 'mail' in reg.php is used directly in a SQL query : $sql = 'SELECT...