CVE-2006-3752: Undefined Security Weakness

Multiple SQL injection vulnerabilities in class.php in Professional Home Page Tools Guestbook allow remote attackers to execute arbitrary SQL commands via the 1 hidemail, 2 name, 3 mail, 4 ip, or 5 text parameters...

CVE-2006-3753: Undefined Security Weakness

setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash...

CVE-2006-3039

Cross-site scripting XSS vulnerability in index.php in Cescripts Realty Home Rent allows remote attackers to inject arbitrary web script or HTML via the selmenu parameter. NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been...

CVE-2006-3039

CVE-2006-3039: A Cross-site Scripting (XSS) vulnerability in Cescripts Realty Home Rent, exploitable via the sel_menu parameter in index.php. The issue allows remote attackers to inject arbitrary script/HTML. The vendor stated on 2006-08-23 that “All issues concerning this script and others at ce...

Nanjing telecommunications user to bypass Huawei Portal activex to achieve broadband sharing method-vulnerability warning-the black bar safety net

Extra programming work: removing annoying Huawei broadband Internet access controls This is a two-day home broadband fails, always too busy no time to check, today, looked, originally is a system upgrade. Due to Huawei's reliance on such a control to do broadband on the landing, leads to the...

CVE-2006-3039: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Cescripts Realty Home Rent allows remote attackers to inject arbitrary web script or HTML via the selmenu parameter. NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been...

CEScripts (Multiple Scripts) - Cross-Site Scripting

CEScripts Multiple Scripts - Cross-Site Scripting source: https://www.securityfocus.com/bid/18402/info CEScripts scripts are prone to multiple cross-site scripting vulnerabilities because they fail to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary...

CEScripts (Multiple Scripts) - Cross-Site Scripting

source: https://www.securityfocus.com/bid/18402/info CEScripts scripts are prone to multiple cross-site scripting vulnerabilities because they fail to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecti...

CVE-2006-2727

The CVE-2006-2727 entry describes a vulnerability in Eggblog prior to version 3.0 where the home/register.php flow allows remote attackers to change the password of administrators (and possibly other users) by supplying a modified username parameter. Affected component: Eggblog web application, l...

CVE-2006-2727: Undefined Security Weakness

home/register.php in Eggblog before 3.0 allows remote attackers to change the password of administrators and possibly other users via a modified username parameter...

Path traversal

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

CVE-2006-2020

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...

CVE-2006-2021

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

CVE-2006-2021

CVE-2006-2021 is an absolute path traversal vulnerability in the Asterisk Recording Interface (ARI) web UI, specifically in recordings/misc/audio.php of Asterisk@Home before 2.8. An unauthenticated attacker can supply a full pathname in the recording parameter to read arbitrary MP3, WAV, and GSM ...

CVE-2006-2020

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...

CVE-2006-2021: Undefined Security Weakness

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

CVE-2006-2020: Undefined Security Weakness

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...

CVE-2006-1892: Undefined Security Weakness

avast! 4 Linux Home Edition 1.0.5 allows local users to modify permissions of arbitrary files via a symlink attack on the /tmp/avast4 temporary directory...

Avast Linux Home Edition (vulnerability on a temporary folder creation)

Title : Avast Linux Home Edition, vulnerability on a temporary folder creation Protuct : Avast! Linux Home Edition Product : http://www.avast.com/eng/download-avast-for-linux-edition.html Version : 1.0.5, 1.0.5-1 avast4workstation-1.0.5-1.i586.rpm avast4workstation-1.0.5.tar.gz Vuln Found :...

Design/Logic Flaw

Laurentiu Matei eXpandable Home Page XHP CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using 1 manager.php, 2 standalonemanager.php, and 3 images.php...