CVE-2011-2154

CVE-2011-2154 affects SmarterTools SmarterStats 6.0 web server. The loginsettings cookie is missing the HTTPOnly flag in the Set-Cookie header, allowing potential script access to the cookie and exposure of sensitive information. The available data from NVD lists a CVSS v2 base score of 5.0 (Medi...

CVE-2011-2154

login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2011-2153

Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2009-2612

CVE-2009-2612 describes an SQL injection in ProSMDR’s login.aspx via the txtUser parameter, enabling remote execution of arbitrary SQL commands. Multiple sources (NVD, Red Hat, CVE records) confirm the vulnerability exists and references to third-party provenance (no vendor-supplied exploit detai...

CVE-2009-0281

The CVE-2009-0281 entry describes an SQL injection vulnerability in the WarHound Walking Club’s login.aspx, exploitable via the (1) username and (2) password parameters. The underlying issue allows remote attackers to attempt arbitrary SQL commands. The provided documents do not specify affected ...

Sql injection

Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the 1 password and 2 username fields...

Sql injection

SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2008-5974

CVE-2008-5974 affects Active Price Comparison 4.0, where the login.aspx page is vulnerable to SQL injection via the (1) username and (2) password fields. The root cause is improper handling of user input in the login form, allowing remote attackers to execute arbitrary SQL commands. The available...

CVE-2008-5973

The CVE-2008-5973 entry describes an SQL injection vulnerability in Active Web Mail 4.0 (login.aspx) that allows an attacker to execute arbitrary SQL commands via the password parameter. Affected component: login form handling in Active Web Mail 4.0. Root cause: improper sanitization of input lea...