CVE-2007-6515

support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string...

CVE-2007-6515

CVE-2007-6515 : TCL injection in SiteScape Forum via support/dispatch.cgi where attacker-supplied code separator characters in the query string enable remote arbitrary TCL code execution. Connected sources document this as a TCL injection issue affecting SiteScape Forum/Enterprise Forum 7.x, with...

CVE-2007-6515: Improper Control of Generation of Code

support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string...

SiteScape Forum TCL injection

Hi, I have following advisory for you. [email protected] SiteScape Forum TCL injection ================================ discovered by [email protected] PRODUCT: SiteScape Forum EXPOSURE: TCL injection SYNOPSIS ======== By URL modification it is possible to insert TCL code into aplication. Accou...

CVE-2007-6495

incnewuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of directories named 1 db, 2 www, 3 Special, and 4 log at arbitrary locations under the web root via a modified Dirroot parameter in an AddUser action to...

CVE-2007-6502

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via 1 the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp, which discloses usernames; and 2 certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or...

CVE-2007-6502

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via 1 the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp, which discloses usernames; and 2 certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or...

CVE-2007-6502

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via 1 the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp, which discloses usernames; and 2 certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or...

SiteScape Forum - dispatch.cgi Tcl Command Injection

SiteScape Forum - dispatch.cgi Tcl Command Injection source: https://www.securityfocus.com/bid/26963/info SiteScape Forum is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary commands in th...

SiteScape Forum - 'dispatch.cgi' Tcl Command Injection

source: https://www.securityfocus.com/bid/26963/info SiteScape Forum is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary commands in the context of the webserver process. Successful exploi...

bttlxe Forum 2.0 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities

bttlxe Forum 2.0 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/26790/info bttlxe Forum is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficientl...

bttlxe Forum 2.0 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/26790/info bttlxe Forum is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker t...

Beehive论坛post.php脚本远程SQL注入漏洞

BUGTRAQ ID: 26492 CVECAN ID: CVE-2007-6014 Beehive Forum是用PHP编写的开源Web论坛应用。 Beehive Forum实现上存输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，非授权操作数据库获取敏感信息。 Beehive论坛的post.php脚本没有正确地过滤用户对tdedupe变量的输入便将该变量的值包含在了SQL语句中并由@mysqlquery函数执行。这个函数经过了特别的设计禁止在单个调用中使用多个SQL语句以缓解SQL注入攻击的影响，但攻击者仍可以通过tdedupe变量操控SQL语句，从数据库获得任意数据。...

Sql injection

SQL injection vulnerability in post.php in Beehive Forum 0.7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tdedupe parameter...

Code injection

Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, different issues than CVE-2007-6014...

CVE-2007-6014

SQL injection vulnerability in post.php in Beehive Forum 0.7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tdedupe parameter...

CVE-2007-6241

Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, different issues than CVE-2007-6014...

CVE-2007-6241

Beehive Forum 0.7.1 and earlier are affected by a SQL injection vulnerability in the post.php script, exploitable via the t_dedupe parameter to execute arbitrary SQL commands remotely. This is caused by insufficient input filtering in t_dedupe, allowing an attacker to manipulate SQL sent to the d...

CVE-2007-6241

Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, different issues than CVE-2007-6014...

CVE-2007-6014

Beehive Forum 0.7.1 and earlier are affected by a SQL injection in post.php via the t_dedupe parameter. The vulnerability allows remote SQL commands to be executed and impacts Beehive Forum’s data. A patch/update has been released by the vendor (Beehive Forum 0.8), and the referenced recovery gui...