191 matches found
FlatNuke 2.5.x - 'index.php' Multiple Remote File Inclusions
source: https://www.securityfocus.com/bid/15172/info FlatNuke is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to execute arbitrary server-side scri...
CVE-2005-2814
Cross-site scripting XSS vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a visreg operation to index.php...
CVE-2005-2813
Directory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00" trailing null byte characters in the id parameter to the read mod in index.php...
CVE-2005-2815
print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information path disclosure on error or cause a denial of service resource consumption via an MS-DOS device name in the news parameter to print.php, such as 1 AUX, 2 CON, 3 PRN, 4 COM1, or 5 LPT1...
CVE-2005-2813
Directory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00" trailing null byte characters in the id parameter to the read mod in index.php...
CVE-2005-2815
print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information path disclosure on error or cause a denial of service resource consumption via an MS-DOS device name in the news parameter to print.php, such as 1 AUX, 2 CON, 3 PRN, 4 COM1, or 5 LPT1...
CVE-2005-2814
Cross-site scripting XSS vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a visreg operation to index.php...
CVE-2005-2814
The CVE-2005-2814 entry concerns FlatNuke 2.5.6 with a Cross-site scripting (XSS) flaw. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a vis_reg operation to index.php. Affected component: the vis_reg flow in index.php; root cause: unsani...
CVE-2005-2813
CVE-2005-2813 concerns FlatNuke 2.5.6 (and possibly earlier) with a directory traversal in index.php reading via the id parameter (read mod), allowing an attacker to read arbitrary files using .. and %00. The connected Nessus/NVD entries confirm the vulnerability path and document that affected s...
CVE-2005-2815
The CVE-2005-2815 entry describes a vulnerability in FlatNuke 2.5.6 where print.php can disclose path information on error or be abused to trigger a denial‑of‑service by supplying an MS‑DOS device name (AUX/CON/PRN/COM1/LPT1) in the news parameter. Affected product: FlatNuke 2.5.6; vulnerability ...
Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
flatnuke256.txt
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
flat256enENa2.txt
Flatnuke 2.5.6 enENa2 possibly prior versions user IP address / information disclosure software: site: http://flatnuke.sourceforge.net/flatnuke/ download link: http://itk.hopto.org:666/work/index.php?mod=Download&dlfile=FlatNukeEn/FlatNukeEn2.5.6a2.zip&mode=go same vuln of simple machine forum,...
FlatNuke 2.5.6 - USR Cross-Site Scripting
FlatNuke 2.5.6 - USR Cross-Site Scripting source: https://www.securityfocus.com/bid/14704/info FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitra...
FlatNuke 2.5.6 - 'ID' Directory Traversal
source: https://www.securityfocus.com/bid/14702/info FlatNuke is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '.....
FlatNuke 2.5.6 - 'USR' Cross-Site Scripting
source: https://www.securityfocus.com/bid/14704/info FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of ...
CVE-2005-2538
FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via 1 a null byte or 2 an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1 in the mod parameter...
CVE-2005-2539
Multiple cross-site scripting XSS vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the 1 bodycolor, 2 backimage, 3 theme, or 4 logo parameter to structure.php, 5 admin, 6 adminmail, or 7 back parameter to footer.php,...
CVE-2005-2538
FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via 1 a null byte or 2 an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1 in the mod parameter...