CVE-2010-0949: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Natychmiast CMS allow remote attackers to inject arbitrary web script or HTML via the idstr parameter to 1 index.php and 2 aindex.php...

CVE-2010-0955: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Bild Flirt Community 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2010-0950: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Natychmiast CMS allow remote attackers to execute arbitrary SQL commands via the idstr parameter to 1 index.php and 2 aindex.php...

CVE-2010-0958: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/hayoo/index.php in Tribisur 2.1, 2.0, and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary files via directory traversal sequences in the theme parameter. NOTE: some of these details are obtained from...

CVE-2010-0952: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OneCMS 2.5, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action...

CVE-2010-0956: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OpenCart 1.3.2 allows remote attackers to execute arbitrary SQL commands via the page parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

Sql injection

SQL injection vulnerability in the HotBrackets Tournament Brackets comhotbrackets component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

Directory traversal

Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus comifnexus component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php...

CVE-2010-0943

Directory traversal vulnerability in the JA Showcase comjashowcase component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter in a jashowcase action to index.php...

CVE-2010-0944

Directory traversal vulnerability in the JCollection comjcollection component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php...

CVE-2009-4678

Winn Guestbook 2.4 is affected by a Cross-site scripting (XSS) vulnerability in index.php, exploitable via PATH_INFO to inject arbitrary web script or HTML. The provided documents identify the vulnerable component as Winn Guestbook 2.4 (index.php) and the exploit vector PATH_INFO but do not inclu...

CVE-2009-4678: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Winn Guestbook 2.4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2010-0943: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the JA Showcase comjashowcase component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter in a jashowcase action to index.php...

CVE-2010-0941: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in eTek Systems Hit Counter 2.0 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 inc/login.php, 3 admin/index.php, and 4 admin/forgot.php...

CVE-2010-0945: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the HotBrackets Tournament Brackets comhotbrackets component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

Design/Logic Flaw

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

CVE-2009-4675

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

Natychmiast CMS Cross Site Scripting / SQL Injection

Title: SQL injection vulnerability in Natychmiast CMS Date: 03.03.2010 Author: Ariko-Security Software Link: http://www.natychmiast-cms.pl/ Version: ALL ============ Ariko-Security - Advisory 2/3/2010 ============= SQL injection and XSS vulnerability in NATYCHMIAST CMS Vendor's Description of...

CVE-2009-4675: Improper Authentication

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...