LogiSphere 0.9.9 j - 'Search?NS-query-pat' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/15807/info LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the...

LogiSphere 0.9.9 j - 'viewsource.jsp?source' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/15807/info LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the...

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...

Web4Future eDating Professional 5.0 - index.php Multiple SQL Injections

Web4Future eDating Professional 5.0 - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/15715/info eDating Professional is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input befor...

Edgewall Software Trac 0.7.1/0.8/0.9 Search Module - SQL Injection

source: https://www.securityfocus.com/bid/15720/info Trac is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromise the...

WebCalendar < 1.0.2 Multiple Vulnerabilities

The remote version of WebCalendar does not validate input to the 'id' and 'format' parameters of the 'exporthandler.php' script before using it to overwrite files on the remote host, subject to the privileges of the web server user id. In addition, the 'activitylog.php', 'adminhandler.php',...

Internet Explorer onload window vulnerability

Added: 12/01/2005 CVE: CVE-2005-1790 BID: 13799 OSVDB: 17094 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Internet Explorer fails to properly initialize the window function when called from an onLoad event in a body tag. This...

Internet Explorer onload window vulnerability

Added: 12/01/2005 CVE: CVE-2005-1790 BID: 13799 OSVDB: 17094 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Internet Explorer fails to properly initialize the window function when called from an onLoad event in a body tag. This...

RSA SecurID Web Agent for IIS redirect buffer overflow

Added: 11/30/2005 CVE: CVE-2005-4734 BID: 26424 OSVDB: 20151 Background RSA SecurID Web Agent for IIS provides access control for IIS web servers using one-time authentication tokens. Problem A buffer overflow in IISWebAgentIF.dll could allow a remote attacker to execute arbitrary commands using ...

WSN Knowledge Base 1.2 - comments.php?id SQL Injection

WSN Knowledge Base 1.2 - comments.php?id SQL Injection source: https://www.securityfocus.com/bid/15656/info WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQ...

SoftBiz FAQ 1.1 - refer_friend.php?id SQL Injection

SoftBiz FAQ 1.1 - referfriend.php?id SQL Injection source: https://www.securityfocus.com/bid/15653/info Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could...

88Scripts Event Calendar 2.0 - index.php SQL Injection

88Scripts Event Calendar 2.0 - index.php SQL Injection source: https://www.securityfocus.com/bid/15658/info 88Scripts Event Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL...

SoftBiz B2B trading Marketplace Script 1.1 - 'products.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/15652/info Softbiz B2B Trading Marketplace is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could...

SoftBiz FAQ 1.1 - 'index.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/15653/info Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application,...

Softbiz Resource Repository Script - 'refer_friend.php?sbres_id' SQL Injection

source: https://www.securityfocus.com/bid/15585/info Softbiz Resource Repository Script is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in...

PHPGreetz 0.99 - Remote File Inclusion

source: https://www.securityfocus.com/bid/15575/info phpGreetz is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote PHP code on an affected comput...

efiction 1.01.12.0 - uid SQL Injection

efiction 1.01.12.0 - uid SQL Injection source: https://www.securityfocus.com/bid/15568/info eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities. These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized...

efiction 1.01.12.0 - titles.php Cross-Site Scripting

efiction 1.01.12.0 - titles.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15568/info eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities. These vulnerabilities may allow an attacker to view and modify sensitive information, gain...

efiction 1.0/1.1/2.0 - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/15568/info eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities. These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying...

vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting

vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting source: https://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is pro...