CVE-2006-1968

Cross-site scripting XSS vulnerability in news/NsVisitor.cgi in KCScripts News Publisher, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter...

Portal Pack 6 XSS vuln.

Portal Pack 6 XSS vuln. Vuln. discovered by : r0t Date: 20 april 2006 vendor:www.kcscripts.com/scripts/portal-pack.htm affected versions:6.0 and prior orginal advisoy: http://pridels.blogspot.com/2006/04/portal-pack-6-xss-vuln.html Vuln. Description: Portal Pack contains a flaws that allows a...

Portal Pack 6.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/17628/info Portal Pack is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed i...

Immunity Canvas: GROUPWISE_MESSENGER

Name| groupwisemessenger ---|--- CVE| CVE-2006-0992 Exploit Pack| CANVAS Description| Groupwise Messenger 2 Buffer Overflow Notes| CVE Name: CVE-2006-0992 VENDOR: Novell Repeatability: You get one shot Date public: 2006-04-13 CVE Url: https://vulners.com/cve/CVE-2006-0992 CVSS: 10.0...

Directory traversal

Multiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0, 3.3.0.0, and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. dot dot in an archive pack with a crafted 1 .gz, 2 .jar, 3 .rar, or 4 .zip file...

CVE-2006-1715

Multiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0, 3.3.0.0, and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. dot dot in an archive pack with a crafted 1 .gz, 2 .jar, 3 .rar, or 4 .zip file...

CVE-2006-1715

Multiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0, 3.3.0.0, and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. dot dot in an archive pack with a crafted 1 .gz, 2 .jar, 3 .rar, or 4 .zip file...

CVE-2006-1715

The CVE-2006-1715 entry concerns Christian Kindahl TugZip (versions 3.4.0.0, 3.3.0.0, 3.1.0.2). The vulnerability arises in archive extraction where a dot-dot (..) path in a crafted archive pack (formats: .gz, .jar, .rar, or .zip) can lead to directory traversal, enabling a user‑assisted attacker...

Microsoft Commerce Server 2002 authfiles/login.asp Authentication Bypass

The version of Microsoft Commerce Server 2002 installed on the remote host may enable an attacker to bypass authentication if the sample files from the 'AuthFiles' folder are installed under the web server's document root. Note that successful exploitation of this issue requires knowledge of the...

Immunity Canvas: HORDE_EVAL

Name| hordeeval ---|--- CVE| CVE-2006-1491 Exploit Pack| CANVAS Description| Horde Eval Notes| CVE Name: CVE-2006-1491 VENDOR: Horde.org Notes: Try using nc -e /bin/sh as your command and having a nc -vlp Repeatability: Infinite CVE Url: https://vulners.com/cve/CVE-2006-1491 CVSS: 7.5...

[SA19308] BEA WebLogic Portal JSR-168 Portlets Rendering Security Issue

TITLE: BEA WebLogic Portal JSR-168 Portlets Rendering Security Issue SECUNIA ADVISORY ID: SA19308 VERIFY ADVISORY: http://secunia.com/advisories/19308/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: BEA WebLogic Portal 8.x...

Immunity Canvas: VSPLOIT_MERCURIMAP

Name| vsploitmercurimap ---|--- CVE| CVE-2006-1255 Exploit Pack| CANVAS Description| Mercur Imap 5.0 Remote Buffer Overflow Notes| CVE Name: CVE-2006-1255 VENDOR: Mercur Repeatability: One time Date public: 03/16/2006 CVE Url: https://vulners.com/cve/CVE-2006-1255 CVSS: 10.0...

Microsoft Commerce Server 2002: Logon as known user with a false password

Microsoft Commerce Server 2002: Logon as known user with a false password Vulnerable: Microsoft Windows Server 2000/2003 + Internet Information Server 5/6 + Commerce Server 2002 Discussion: Microsoft Commerce Server is used by company's who want to give customers the opportunity to change there o...

Microsoft Commerce Server authentication bypass

It's possible to login with known username without password. Fixed with Service Pack 2...

Microsoft Windows - Telephony Service Command Execution (MS05-040)

// by Cesar Cerrudo - Argeniss - www.argeniss.com // // TAPI Vulnerability- MS05-040 // // Should work on Win2k sp0,sp1,sp2,sp3,sp4 any language // If Telephony Service is not running you can start it by net start "Telephony Service" include "windows.h" include "stdio.h" include "tapi.h" typedef...

Microsoft Security Bulletin MS06-006 Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution (911564)

Microsoft Security Bulletin MS06-006 Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution 911564 Published: February 14, 2006 Version: 1.0 Summary Who should read this document: Customers who use a Microsoft Windows Media Player...

Integer overflow

Borland C++Builder 6 BCB6 with Update Pack 4 Enterprise edition entupd4 evaluates the "isizeofint" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers...

CVE-2006-0634

Borland C++Builder 6 BCB6 with Update Pack 4 Enterprise edition entupd4 evaluates the "isizeofint" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers...

CVE-2006-0634

CVE-2006-0634 — The provided materials identify Borland C++Builder 6 (BCB6) with Update Pack 4 Enterprise (ent_upd4) as affected. The root cause described is that evaluating the expression i > sizeof(int) yields false when i equals -1, which could introduce integer overflow vulnerabilities in ...

CVE-2006-0634

Borland C++Builder 6 BCB6 with Update Pack 4 Enterprise edition entupd4 evaluates the "isizeofint" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers...