CVE-2009-1223

CVE-2009-1223 affects aspWebCalendar Free Edition. The vulnerability arises from storing sensitive information under the web root with insufficient access control, enabling remote attackers to download a calendar.mdb database containing user credentials via a direct request to calendar/calendar.m...

aspWebCalendar Free Edition bug

I'm not sure how to classify this bug / vulnerability, but for aspWebCalendar Free edition, you can openly download the mdb file and read its contents username,pasword. Example http://www.example.com/calendar/calendar.mdb I guess the fix would be to place the mdb file outside of wwwroot...

aspWebCalendar Free Edition Database Disclosure

I'm not sure how to classify this bug / vulnerability, but for aspWebCalendar Free edition, you can openly download the mdb file and read its contents username,pasword. Example http://www.example.com/calendar/calendar.mdb I guess the fix would be to place the mdb file outside of wwwroot...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via 1 the e-mail address, 2 a comment, which is not properly handled during moderation, and 3 the tag parameter to gallery/tags.php...

CVE-2008-6567

Multiple cross-site scripting XSS vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via 1 the e-mail address, 2 a comment, which is not properly handled during moderation, and 3 the tag parameter to gallery/tags.php...

CVE-2008-6567

CVE-2008-6567 describes multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition. The impact, per the sources, allows remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment not properly handled during moderation, and (3) the tag par...

CVE-2008-6567

Multiple cross-site scripting XSS vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via 1 the e-mail address, 2 a comment, which is not properly handled during moderation, and 3 the tag parameter to gallery/tags.php...

CVE-2008-6374

CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to db/MailingList.mdb...

RealVNC VNC Viewer Remote Code Execution Vulnerability (Linux)

This host has RealVNC VNC Viewer installed and is prone to security vulnerability. The flaw is due to error in 'CMsgReader::readRect' function in common/rfb/CMsgReader.cxx processing encoding types, and is exploited by sending specially crafted messages to the application. OpenVAS Vulnerability...

Sql injection

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

Design/Logic Flaw

Gallarific Free Edition 1.1 does not require authentication for 1 photos.php, 2 comments.php, and 3 gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information is unknown; the details ar...

CVE-2008-1469

Gallarific Free Edition 1.1 does not require authentication for 1 photos.php, 2 comments.php, and 3 gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information is unknown; the details ar...

CVE-2008-1464

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2008-1464

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2008-1464

Gallarific Free Edition 1.1 is affected by multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL commands via input fields in distinct endpoints: the query parameter to search.php; gusername and gpassword to login.php; and username/password to gadmin/i...

CVE-2008-1469

CVE-2008-1469 refers to Gallarific Free Edition 1.1, where the components in gadmin/ (photos.php, comments.php, gallery.php) do not require authentication. This enables remote attackers to edit objects via a direct request, with the description noting this is a different vector than CVE-2008-1327...

CVE-2008-1469

Gallarific Free Edition 1.1 does not require authentication for 1 photos.php, 2 comments.php, and 3 gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information is unknown; the details ar...

NetClassifieds - SQL Injection / Cross-Site Scripting / Full Path

Application: NetClassifieds: -Free Edition -Standard Edition -Professional Edition -Premium Edition Web Site: http://www.scriptdevelopers.net/ Versions: all Platform: linux, windows Bug: multiple injection sql , xss , full path Fix Available: Yes...

ManageEngine Password Manager Pro Build 5401 - Database Remote Unauthorized Access

source: https://www.securityfocus.com/bid/23693/info ManageEngine Password Manager Pro is prone to a remote unauthorized-access vulnerability due to a design error. An attacker may leverage this issue to gain unauthorized access to the application's database with administrative privileges...

ManageEngine Password Manager Pro Build 5401 - Database Remote Unauthorized Access

ManageEngine Password Manager Pro Build 5401 - Database Remote Unauthorized Access source: https://www.securityfocus.com/bid/23693/info ManageEngine Password Manager Pro is prone to a remote unauthorized-access vulnerability due to a design error. An attacker may leverage this issue to gain...