CVE-2005-4484: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 retpage parameter to login.asp or the 2 dosearch and 3 search parameters to content.asp...

CVE-2005-4483: Undefined Security Weakness

Cross-site scripting XSS vulnerability in login.asp in SiteEnable 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the retpage parameter...

CVE-2005-4482: Undefined Security Weakness

Cross-site scripting XSS vulnerability in login.asp in PortalApp 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the retpage parameter...

SiteEnable XSS vuln.

SiteEnable XSS vuln. Vuln. discovered by : r0t Date: 21 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/siteenable-xss-vuln.html vendor:http://www.siteenable.com/ affected version:3.3 and prior Product Description: SiteEnable is an open source Web application that combines content...

CVE-2005-3480

CVE-2005-3480 affects Ringtail CaseBook 6.1.0 where login.asp returns distinct error messages for valid vs. invalid usernames, enabling remote attackers to enumerate valid usernames. The connected documents corroborate that the issue is an informational disclosure in authentication messages, with...

CVE-2005-3479

CVE-2005-3479 describes a cross-site scripting (XSS) flaw in Ringtail CaseBook 6.1.0, specifically in login.asp where an attacker can inject arbitrary script via the users parameter. Affected software is Ringtail CaseBook 6.1.0; the vulnerability arises from improper handling of the users input, ...

CVE-2005-3480: Undefined Security Weakness

login.asp in Ringtail CaseBook 6.1.0 displays different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...

CVE-2005-3479: Undefined Security Weakness

Cross-site scripting XSS vulnerability in login.asp in Ringtail CaseBook 6.1.0 allows remote attackers to inject arbitrary web script or HTML via the users parameter...

CVE-2005-3384

SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3385

The CVE-2005-3385 entry describes a SQL injection vulnerability in Techno Dreams Mailing List script that allows remote attackers to execute arbitrary SQL and bypass authentication via the userid parameter in admin/login.asp. Affected component: the Mailing List script; vulnerability type: SQL in...

CVE-2005-3386: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3385: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3383: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3384: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-2440

SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via the svmPassword parameter...

CVE-2005-2440

CVE-2005-2440 affects Thomson Web Skill Vantage Manager: a SQL injection vulnerability exists in login.asp via the svmPassword parameter. Root cause is improper handling/sanitization of user input in the login flow, enabling remote attackers to craft SQL statements executed by the backend. The vu...

CVE-2005-2440: Undefined Security Weakness

SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via the svmPassword parameter...

CVE-2005-2207: Undefined Security Weakness

Cross-site scripting XSS vulnerability in store/login.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via the message parameter...

CVE-2004-2210: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Express-Web Content Management System CMS allow remote attackers to steal cookie-based authentication information and possibly perform other exploits via the 1 n, 2 b, 3 e, or 4 a parameters to default.asp, 5 the Referer header in an HTTP reque...

Ipswitch WhatsUp Professional Login.asp Multiple Field SQL Injection

The remote host is running Ipswitch WhatsUp Professional, a network management and monitoring package. The web front-end for WhatsUp Professional on the remote host is prone to a SQL injection attack because it fails to sanitize the 'sUserName' and 'sPassword' parameters in the 'Login.asp' script...