[Full-disclosure] SEC Consult SA-20051223-1 :: File Disclosure using df_next_page parameter in OracleAS Discussion Forum Portlet

SEC Consult Security Advisory 20051223-1 ======================================================================== title: File Disclosure using dfnextpage parameter in OracleAS Discussion Forum Portlet program: OracleAS Discussion Forum Portlet vulnerable version: Version of May 2005 homepage:...

Beehive Forum 0.6.2 - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/16521/info Beehive Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. Successful exploitation can allow an attacker to bypass authentication and gain administrative...

Beehive Forum 0.6.2 - index.php SQL Injection

Beehive Forum 0.6.2 - index.php SQL Injection source: https://www.securityfocus.com/bid/16521/info Beehive Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. Successful exploitation can allow an attacker to...

[KAPDA::#17] - beehiveforum Script Injection

KAPDA New advisory Vendor: http://www.beehiveforum.net Vulnerable: Version 0.6.2 Bug: HTML Injection , Possible attacks with registerglobals = On Exploitation: Remote with browser Description: -------------------- Beehive Forum is a PHP-based message board system that uses a MySQL database...

CVE-2005-4460

Cross-site scripting XSS vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Description, and 3 Comment fields to a links.php and b linksadd.php...

CVE-2005-4461

SQL injection vulnerability in index.php in Beehive Forum 0.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the usersess parameter...

CVE-2005-4460

Beehive Forum before or at version 0.6.2 is affected by a cross-site scripting (XSS) vulnerability in links.php and links_add.php. The issue allows remote attackers to inject arbitrary web script or HTML via the Name, Description, and Comment fields. The CVE-2005-4460 description in the provided ...

CVE-2005-4461

The CVE-2005-4461 entry concerns Beehive Forum (version 0.6.2 and earlier) with a SQL injection in index.php triggered by the user_sess parameter. The underlying issue allows an attacker to remotely execute arbitrary SQL commands, affecting the database via the vulnerable script. The available re...

CVE-2005-4460

Cross-site scripting XSS vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Description, and 3 Comment fields to a links.php and b linksadd.php...

CVE-2005-4461

SQL injection vulnerability in index.php in Beehive Forum 0.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the usersess parameter...

ProjectApp 3.3 - 'forums.asp?keywords' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16011/info ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in...

CVE-2005-4461: Undefined Security Weakness

SQL injection vulnerability in index.php in Beehive Forum 0.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the usersess parameter...

CVE-2005-4460: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Description, and 3 Comment fields to a links.php and b linksadd.php...

Beehive Forum 0.6.2 - Multiple HTML Injection Vulnerabilities

Beehive Forum 0.6.2 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/16002/info Beehive Forum is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in...

From PHP Forum the vulnerability of the endoscope security management-vulnerability warning-the black bar safety net

From: ReJeCt‘s Blog Blue magic Forum is a PHP Forum in the country is widely used. Due to its user registration module in some code defect that can lead to a malicious attacker will be normal users to elevate to administrator. First let's look at an invasion of the examples. The invasion paradigm...

jPORTAL 2.2.12.3 Forum - forum.php SQL Injection

jPORTAL 2.2.12.3 Forum - forum.php SQL Injection source: https://www.securityfocus.com/bid/15925/info JPortal Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

jPORTAL 2.2.1/2.3 Forum - 'forum.php' SQL Injection

source: https://www.securityfocus.com/bid/15925/info JPortal Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

Remember the Alma Mater of a non-marginalia attack-vulnerability warning-the black bar safety net

Editor's note: a very old article, The author has also not been released, I steal it out for everyone to draw on the following ideas． A． Causes. School of the FAI says he sent the on-campus DV reviews old deleted, so they want to test the forum security, then on the use side note got the...

CVE-2005-4307

Cross-site scripting XSS vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to 1 forum.cgi and 2 post.cgi, or 3 the user parameter to profile.cgi...

CVE-2005-4307

The CVE-2005-4307 entry concerns an XSS vulnerability in ScareCrow 2.13 and earlier. The affected components are the forum.cgi, post.cgi, and profile.cgi endpoints, where attacker-controlled input via the forum parameter (for forum.cgi and post.cgi) or the user parameter (for profile.cgi) can inj...