Sql injection

SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter to 1 login.asp and 2 main.asp...

Information disclosure

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2357

Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp...

CVE-2006-2354

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2354

CVE-2006-2354 affects Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium. NmConsole/Login.asp generates different error messages that enable remote attackers to enumerate valid usernames. Root cause is information-disclosing behavior in login error handling. CVSS 2.0 base sc...

CVE-2006-2354: Undefined Security Weakness

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2357: Undefined Security Weakness

Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp...

CVE-2006-2179: Undefined Security Weakness

Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the 1 SessionID parameter to login.asp or 2 ProductIndex parameter to browse0.htm...

CVE-2006-1156

SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp...

CVE-2006-1156: Undefined Security Weakness

SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp...

CVE-2006-1155: Undefined Security Weakness

Cross-site scripting XSS vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in 1 login.asp and 2 default.asp...

CVE-2006-1000: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 newsid parameter to newsdetailsview.asp and 2 password parameter to login.asp...

CVE-2006-0911

CVE-2006-0911 affects Ipswitch WhatsUp Professional 2006. The vulnerable component is NmService.exe handling requests to Login.asp. The underlying issue is triggered by crafted requests that use the parameters (1) "In]" and (2) "b;tnLogIn", or (3) malformed btnLogIn, potentially involving missing...

CVE-2006-0911

NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service CPU consumption via crafted requests to Login.asp, possibly involving the 1 "In" and 2 "b;tnLogIn" parameters, or 3 malformed btnLogIn parameters, possibly involving missing "" open bracket or...

CVE-2006-0911: Undefined Security Weakness

NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service CPU consumption via crafted requests to Login.asp, possibly involving the 1 "In" and 2 "b;tnLogIn" parameters, or 3 malformed btnLogIn parameters, possibly involving missing "" open bracket or...

CVE-2006-0490

The CVE-2006-0490 entry describes an SQL injection vulnerability in login.asp of ASPThai.Net ASPThai Forums 8.0 and earlier , enabling remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field. No exploit details or remediation are provided in the c...

CVE-2006-0490: Undefined Security Weakness

SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field...

CVE-2006-0192: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in LoginValidate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp...

CVE-2005-4483

Cross-site scripting XSS vulnerability in login.asp in SiteEnable 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the retpage parameter...

CVE-2005-4482

The CVE-2005-4482 entry describes a Cross-site Scripting (XSS) vulnerability in PortalApp 3.3 and earlier, exploitable via the ret_page parameter in login.asp. Affected component: login.asp within PortalApp; root cause: improper handling of the ret_page input enables injection of arbitrary script...