CVE-2002-0287: Undefined Security Weakness

pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default...

phpnuke60.txt

Informations : °°°°°°°°°°°°°° Language : PHP Website : http://www.phpnuke.org Versions : 6.0 & 6.5? Modules : MembersList, YourAccount Problem : SQL Injection PHP Configuration : This will work if magicquotesgpc=OFF. PHP Code/Location : °°°°°°°°°°°°°°°°°°° /modules/MembersList/index.php :...

CVE-2002-1160

The default configuration of the pamxauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su...

CVE-2002-1969

Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service crash via an invalid username during login...

phpGB: mysql injection bug

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following mysql-injection-bug in phpGB: Details - ------- Product: phpGB Affected Version: 1.20 and maybe all versions before Immune Version: 1.40 OS affected: all OS with php Vendor-URL: http://www.walzl.net Vendor-Status:...

Magic Enterprise contains multiple shell scripts that allow arbitrary file overwriting via symlink redirection of temporary file

Overview Some versions of Magic eDeveloper Enterprise Edition contain a symbolic-link vulnerability that allows attackers to overwrite data or execute arbitrary commands. Description Magic eDeveloper is a development environment for large-scale and distributed applications.Magic eDeveloper...

Several problems in CARE 2002

Several problems in CARE 2002 ------------------------------------- What is CARE 2002? CARE 2002 is a free software package for hospitals. It's based on php + mysql. For further information visit http://www.care2x.com/. include + NULL problem Problem description There are several include statemen...

CVE-2002-0536

PHPGroupware 0.9.12 and earlier, when running with the magicquotesgpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack...

CVE-2002-0287

pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default...

Security holes : XMB Magic Lantern forum & DevBB

Hi all : Product 1 : XMB Magic Lantern forum 1.6b final http://www.xmbforum.com http://www.aventure-media.co.uk Problems : - Reading of logs files - XSS - Path Disclosure - Access to users/admins accounts - Logs distortion Exploits : - /indexlog.log - /cplogfile.log - If indexlog not chmod 777 =...

XMB Forum 1.6 - Magic Lantern Cross-Site Scripting

XMB Forum 1.6 - Magic Lantern Cross-Site Scripting source: https://www.securityfocus.com/bid/4721/info XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. 1. The first involves...

CVE-1999-1384

Indigo Magic System Tour in the SGI system tour package (systour) for IRIX 5.x–6.3 allows local users to gain root privileges via a Trojan horse .exitops program invoked by the inst command executed by RemoveSystemTour. The issue is localized to affected IRIX/SYSTOUR components and involves a use...

CVE-1999-1384

Indigo Magic System Tour in the SGI system tour package systour for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program...

CVE-1999-1116

The CVE-1999-1116 entry concerns SGI IRIX 6.3 and 6.4, where the Indigo Magic System Administration subsystem’s runpriv component allows local users to gain root privileges due to an unspecified issue in its privilege handling. The vulnerability is described as enabling local privilege escalation...

CVE-1999-1116: Undefined Security Weakness

Vulnerability in runpriv in Indigo Magic System Administration subsystem of SGI IRIX 6.3 and 6.4 allows local users to gain root privileges...

CVE-1999-1384: Undefined Security Weakness

Indigo Magic System Tour in the SGI system tour package systour for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program...

XMB Forum 1.6 pre-beta - Image Tag Script Injection

XMB Forum 1.6 pre-beta - Image Tag Script Injection source: https://www.securityfocus.com/bid/4167/info The Extreme Message Board XMB 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between img and...

MAGIC Enterprise Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 immutec Security Advisory ID: SA-MAGIC-001 Date: 2001/12/17 Version: 0.2 Magic Enterprise multiple vulnerabilities Affected Software/System: ========================= Vendor : Magic Software http://www.magicsoftware.com Product : Magic Enterprise...

Многочисленные ошибки в Magic

переполнения буфера, нефильтруемые спец-символы, проблемы символьных линков и т.д...

CVE-2001-1448

Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the 1 mkuserproc, 2 mgrnt, and 3 mgdatasrvr.sc scripts...