CVE-2007-5404: Exposure of Sensitive Information to an Unauthorized Actor

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

CVE-2007-5403: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

[SA27699] Layton HelpBox Multiple Vulnerabilities

---------------------------------------------------------------------- A new version 0.9.0.0 - Release Candidate 1 of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today:...

CVE-2004-2551

CVE-2004-2551 describes multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1. The issue allows remote attackers to inject arbitrary SQL commands through a set of input parameters across various scripts (editcommentenduser.asp, editsuspensionuser.asp, export_data.asp, manageanalgrouppref...

CVE-2004-2551

Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via 1 the syscommentid parameter in editcommentenduser.asp, 2 the syssuspendid parameter in editsuspensionuser.asp, 3 the table parameter in exportdata.asp, 4 the sysanalgroup...

CVE-2004-2551: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via 1 the syscommentid parameter in editcommentenduser.asp, 2 the syssuspendid parameter in editsuspensionuser.asp, 3 the table parameter in exportdata.asp, 4 the sysanalgroup...

CVE-2004-2551

Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via 1 the syscommentid parameter in editcommentenduser.asp, 2 the syssuspendid parameter in editsuspensionuser.asp, 3 the table parameter in exportdata.asp, 4 the sysanalgroup...