1202 matches found
CVE-2002-1458
Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, 3 Subject and 4 Body...
CVE-2002-1459
CVE-2002-1459 is a cross-site scripting vulnerability in L-Forum versions 2.40 and earlier, where the option “Enable HTML in messages” off allows remote insertion of script/HTML via From, E‑Mail, or Subject fields. Root cause: insufficient input validation/escaping in message fields. According to...
CVE-2002-1458
CVE-2002-1458 is a cross-site scripting vulnerability in L-Forum 2.40 and earlier when the option “Enable HTML in messages” is enabled. The vulnerability allows remote attackers to inject arbitrary script or HTML via message fields such as From, E-Mail, Subject, and Body . The NVD entry assigns a...
CVE-2002-1460
L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST attachment, attachmentname, attachmentsize and attachmenttype, which allows remote attackers to read arbitrary files...
CVE-2002-1459
Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, and 3 Subject...
CVE-2002-1458
Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to insert arbitrary script or HTML via message fields including 1 From, 2 E-Mail, 3 Subject and 4 Body...
CVE-2002-1460
CVE-2002-1460 affects L-Forum 2.40 and earlier. The issue is improper verification of uploaded files and associated POST variables (attachment, attachment_name, attachment_size, attachment_type), enabling remote attackers to read arbitrary files. The connected documents confirm the affected softw...
CVE-2002-1457
SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter...
CVE-2002-1457
CVE-2002-1457 targets L-Forum 2.40. It describes a SQL injection in search.php via the search parameter that could allow remote attackers to execute arbitrary SQL statements. The connected documents confirm the affected software (L-Forum 2.40) and the vulnerable component (search.php) with the un...
L-Forum XSS and upload spoofing
L-Forum XSS and upload spoofing PROGRAM: L-Forum VENDOR: Leszek Krupinski [email protected] HOMEPAGE: http://l-forum.x-php.net/ VULNERABLE VERSIONS: 2.4.0, possibly others IMMUNE VERSIONS: none, but an official patch is available for some issues SEVERITY: high LOGIN REQUIRED: no DESCRIPTION: "L-Foru...
L-Forum Vulnerability - SQL Injection
I have discovered an SQL injection flaw in L-Forum which has a recent record upload spoofing/XSS by Ulf of security bugs. The problem this time is search.php. It doesn't properly escape the SQL data passed in by the user in the search member. I have provided a SourceForge patch for this...
Leszek Krupinski L-Forum 2.4 - Search Script SQL Injection
Leszek Krupinski L-Forum 2.4 - Search Script SQL Injection source: https://www.securityfocus.com/bid/5468/info Reportedly, L-Forum is vulnerable to SQL injection attacks. The vulnerability lies in the file 'search.php' L-Forum does not properly sanitize user input that is used as part of the sear...
Leszek Krupinski L-Forum 2.4 - Search Script SQL Injection
source: https://www.securityfocus.com/bid/5468/info Reportedly, L-Forum is vulnerable to SQL injection attacks. The vulnerability lies in the file 'search.php' L-Forum does not properly sanitize user input that is used as part of the search parameter in the 'search.php' file. SQL code may be...
CVE-2000-0632
The CVE-2000-0632 entry concerns a buffer overflow in the web archive component of L-Soft Listserv 1.8d and earlier. The vulnerability allows remote attackers to execute arbitrary commands via a long query string. Public sources (NVD/CVE records and CVE List) consistently describe this as a remot...
CVE-2000-0632
Buffer overflow in the web archive component of L-Soft Listserv 1.8d and earlier allows remote attackers to execute arbitrary commands via a long query string...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Network Associates, Inc. COVERT Labs Security Advisory July 17, 2000 LISTSERV Web Archive Remote Overflow COVERT-2000-07 o Synopsis The L-Soft LISTSERV web archive wa,wa.exe component contains an unchecked buffer allowing remote execution of arbitrary...
CVE-2000-0632
Buffer overflow in the web archive component of L-Soft Listserv 1.8d and earlier allows remote attackers to execute arbitrary commands via a long query string...
CVE-2000-0425
Buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8 allows remote attackers to execute arbitrary commands...
CVE-2000-0425
The CVE-2000-0425 describes a buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8, enabling remote attackers to execute arbitrary commands. Affected product: LISTSERV 1.8 (Web Archives component). Root cause: a buffer overflow likely due to improper input handling in the Web Arch...