CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2701

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2701

The CVE-2006-2701 issue affects Geeklog ≤ 1.4.0sr2, and is a SQL injection vulnerability in the story submission path that could allow remote attackers to execute arbitrary SQL commands. The connected documents confirm affected software and the underlying vulnerability type but do not provide con...

CVE-2006-2700

CVE-2006-2700 affects Geeklog 1.4.0sr2 and earlier, with a SQL injection in admin/auth.inc.php via the loginname parameter that can enable remote arbitrary SQL execution and authentication bypass. Connected sources indicate the issue is part of Geeklog

CVE-2006-2700

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

CVE-2006-2699

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier is affected by a path-disclosure vulnerability. Remote attackers can obtain the full installation path by sending direct requests to layout/professional/functions.php or getimage.php with possibly invalid arguments. No remediation details are provided in the supplied ...

CVE-2006-2699

Geokay: CVE-2006-2699 is a documented Cross-site Scripting (XSS) vulnerability in Geeklog 1.4.0sr2 and earlier. The flaw exists in getimage.php’s show action where the image parameter can be exploited to inject arbitrary HTML or web script, enabling remote attackers to run injected content in a v...

CVE-2006-2698

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2701: Undefined Security Weakness

SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission...

CVE-2006-2698: Undefined Security Weakness

Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to 1 layout/professional/functions.php or 2 getimage.php...

CVE-2006-2700: Undefined Security Weakness

SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter...

Geeklog auth.inc.php loginname Parameter SQL Injection

The version of Geeklog installed on the remote fails to sanitize input to the 'loginname' and 'passwd' parameters before using it in the script 'admin/auth.inc.php' to construct database queries. Provided PHP's 'magicquotesgpc' setting is enabled, an unauthenticated attacker can exploit this flaw...

CVE-2006-2699: Undefined Security Weakness

Cross-site scripting XSS vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action...

[KAPDA::#45] - geeklog multiple vulnerabilities

KAPDA New advisory Vendor: http://www.geeklog.net Bugs: Path Disclosure, XSS, SQL Injection Authentication bypass Vulnerable Version: geeklog-1.4.0sr2prior versions also may be affected Exploitation: Remote with browser Description: -------------------- geeklog is a freely available PHP-based web...

Geeklog < 1.4.0sr3 Multiple Injection Vulnerabilities

Binary data 3635.prm...

Geeklog 1.4 - Multiple Input Validation Vulnerabilities

Geeklog 1.4 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/18154/info Geeklog is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the applicati...

Geeklog 1.4 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/18154/info Geeklog is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. A successfu...

Geeklog lib-sessions.php Session Cookie Handling Authentication Bypass

The version of Geeklog installed on the remote contains a flaw in its session-handling library that can be exploited by an attacker to bypass authentication and gain access as any user, including the admin. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...