[eVuln] Magic Calendar Lite Authentication Bypass

New eVuln Advisory: Magic Calendar Lite Authentication Bypass http://evuln.com/vulns/71/summary.html --------------------Summary---------------- eVuln ID: EV0071 CVE: CVE-2006-0673 Vendor: Reamday Enterprises Vendor's Web Site: http://reamdaysoft.com Software: Magic Calendar Lite Sowtware's Web...

Authentication flaw

profile.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are not...

Remote file inclusion

PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to include arbitrary files via a URL in the phpscriptpath parameter...

CVE-2006-0722

settings.php in Reamday Enterprises Magic Downloads 1.1.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are no...

CVE-2006-0724

CVE-2006-0724 affects Reamday Enterprises’ Magic News Lite 1.2.3. The vulnerability exists in profile.php where several parameters (action, passwd, admin_password, new_passwd, confirm_passwd) are not initialized when register_globals is enabled. This allows remote attackers to modify program beha...

CVE-2006-0723

PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to include arbitrary files via a URL in the phpscriptpath parameter...

CVE-2006-0723

The CVE-2006-0723 entry affects Reamday Enterprises’ Magic News Lite 1.2.3. It is a PHP remote file inclusion in preview.php when register_globals is ON, allowing a remote attacker to include arbitrary files via a URL in the php_script_path parameter. The vulnerability arises from an include() ca...

CVE-2006-0722

CVE-2006-0722 affects Reamday Enterprises’ Magic Downloads 1.1.3. When register_globals is ON, the vulnerable settings.php allows remote attackers to modify program behavior via uninitialized variables (action, passwd, admin_password, new_passwd, confirm_passwd), potentially bypassing authenticat...

CVE-2006-0722

settings.php in Reamday Enterprises Magic Downloads 1.1.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are no...

CVE-2006-0724

profile.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are not...

[eVuln] 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities

New eVuln Advisory: 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities http://evuln.com/vulns/62/summary.html --------------------Summary---------------- eVuln ID: EV0062 CVE: CVE-2006-0610 Software: 2200net Calendar system Sowtware's Web Site:...

CVE-2006-0723: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to include arbitrary files via a URL in the phpscriptpath parameter...

CVE-2006-0722: Undefined Security Weakness

settings.php in Reamday Enterprises Magic Downloads 1.1.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are no...

CVE-2006-0724: Undefined Security Weakness

profile.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are not...

Sql injection

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0673

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

CVE-2006-0673

CVE-2006-0673 affects Magic Calendar Lite 1.02. The vulnerability is a SQL injection in cms/index.php, exploitable when magic_quotes_gpc is off, via the parameters $total_login and $total_password . Outcomes include unauthorized SQL command execution against the backend. Public sources (NVD and e...

linpha_10_local.txt

------------- Linpha = 1.0 multiple arbitrary local inclusion ----------------- software: site: http://linpha.sourceforge.net/nuke/ description: " LinPHA is an easy to use, multilingual, flexible photo / image archive / album / gallery written in PHP. It uses a SQL database to store information...

CVE-2006-0673: Undefined Security Weakness

Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 $totallogin and 2 $totalpassword parameter...

LinPHA <= 1.0 Multiple Vulnerabilities

The remote host is running LinPHA, a web photo gallery application written in PHP. The installed version of LinPHA suffers from a number of flaws, several of which could allow an unauthenticated attacker to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the...