Security Advisory: Woltlab Burning Board Lite formmail.php XSS

Advisory Information -------------------- Advisory name : Woltlab Burning Board Lite formmail.php XSS Discovered by : drhankey / it-security23.net Vendor Name : Woltlab Vendor Homepage : http://www.woltlab.de Software : Woltlab Burning Board Lite Vulnerability Type : Cross-Site-Scripting Vulnerab...

CVE-2004-2229

Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privileges...

CVE-2004-2195

PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter...

CVE-2004-2196

Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to 1 admpages.php, 2 corrpages.php, 3 delblock.php, 4 delpage.php, 5 footer.php, 6 home.php, and others...

CVE-2004-1845

Multiple cross-site scripting XSS vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to commentadd.asp, 2 search parameter to search.asp, or 3 n parameter to categorynewsheadline.asp...

Zanfi CMS Lite index.php inc Parameter Remote File Inclusion

The remote host is running Zanfi CMS Lite, a content management system written in PHP. There is a bug in the remote version of this software that may allow an attacker to execute arbitrary commands on the remote host by using a file inclusion bug in the file 'index.php'. An attacker may execute...

Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration

Title: Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration. Software: News Manager Lite 2.5 & News Manager Lite administration. Vendor: http://www.expinion.net/software/appnewsmanager.asp Impact: Disclosure of authentication information, Disclosure of user information,...

newsmanlite25.txt

Title: Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration. Software: News Manager Lite 2.5 & News Manager Lite administration. Vendor: http://www.expinion.net/software/appnewsmanager.asp Impact: Disclosure of authentication information, Disclosure of user information,...

CVE-2004-1846

Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the 1 ID parameter to more.asp, 2 ID parameter to categorynews.asp, or 3 filter parameter to newssort.asp...

CVE-2004-1847

News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in the NEWSLOGIN cookie...

Expinion.net News Manager Lite 2.5 - 'NEWS_LOGIN?admin' Cookie Authentication Bypass

source: https://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the 'commentadd.asp', 'search.asp',...

Expinion.net News Manager Lite 2.5 - 'search.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the 'commentadd.asp', 'search.asp',...

CVE-2004-0260: Undefined Security Weakness

The AddToMailingList function in CactuSoft CactuShop 5.0 Lite contains a backdoor that allows remote attackers to delete arbitrary files via an email address that starts with |||...

CVE-2004-0046

Cross-site scripting XSS vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' double quote character...

CVE-2004-0046

The CVE-2004-0046 entry describes an XSS vulnerability in SnapStream PVS LITE. The issue allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' character. Affected component: SnapStream PVS LITE web interface; root cause: improper handling of...

CVE-2004-0046

Cross-site scripting XSS vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' double quote character...

CVE-2004-0046: Undefined Security Weakness

Cross-site scripting XSS vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' double quote character...

SnapStream PVS Lite 2.0 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/9375/info SnapStream PVS Lite is prone to a cross-site scripting vulnerability. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a system hosting the software that contains embedded HTML and script code. The...

CVE-2003-1365

The escapedangerouschars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including 1 "" backslash, 2 "?", 3 "" tilde, 4 "^" carat, 5 newline, or 6 carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands...

WebX.txt

hello, i am sending you a security advisory for WebX lite 1.1 web server. ---- -=- Freedom of Voice - Freedom of Choice =- ------------------------------------------------------------------ http://members.lycos.co.uk/r34ct/ security advisory...