PT-2011-1777

Name of the Vulnerable Software and Affected Versions MHP DownloadScript versions 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the Name parameter in the "admin/login.php" endpoint. Recommendations For version 2.2, consider restricting...

PT-2011-4426

Name of the Vulnerable Software and Affected Versions Phorum versions prior to 5.2.17 Description The issue allows remote attackers to inject arbitrary web script or HTML via the real name parameter in the control.php file of the controlcenter. This can lead to cross-site scripting XSS attacks...

Heap overflow

Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-name parameter in a printer-url...

CVE-2011-1701

Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-name parameter in a printer-url...

PT-2010-5564

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions 3.6.4000.0 and earlier Description A directory traversal issue allows remote attackers to read arbitrary files by including a .. dot dot in the file name parameter of an open request. Recommendations For versions...

PT-2010-5393

Name of the Vulnerable Software and Affected Versions Radius Manager version 3.8.0 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the name or descr parameter in an "update usergroup" or "store nas" action to...

CVE-2010-3486: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a 1 ../ dot dot slash, 2 %5C encoded backslash, or 3 %255c double-encoded backslash in the name parameter...

CVE-2010-2574

Cross-site scripting XSS vulnerability in manageprojcatadd.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action...

CVE-2010-2574: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manageprojcatadd.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action...

WhiteBoard 0.1.30 Blind SQL Injection

WhiteBoard 0.1.30 Multiple Blind SQL Injection Vulnerabilities Name WhiteBoard Vendor http://sarosoftware.com Versions Affected 0.1.30 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-24 X. INDEX I. ABOUT THE...

CVE-2010-2464: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the RSComments comrscomments component 1.0.0 Rev 2 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 website and 2 name parameters to index.php...

CVE-2010-2269

Directory traversal vulnerability in loadstatic.cgi in Accoria Web Server aka Rock Web Server 1.4.7 allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2009-4856: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2010-1712: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name and possibly 2 message parameters. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter...

CVE-2009-4560: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter...

CVE-2009-4140

Unrestricted file upload vulnerability in ofcuploadimage.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when registerglobals is enabled, allows remote authenticated users to...

CVE-2009-3469: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter...

Authentication flaw

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."...