384 matches found
social-sql.txt
HACKATTACK Advisory 2008-11-20Social Engine 2.7 CRLF Injection + SQL injection Details Product: Social Engine Security-Risk: moderate Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Vendor-Status: informed Advisory-Status: published Credits Discovered by: David Vieira-Kurz of...
Session fixation
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
CVE-2008-4649
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...
Stash 1.0.3 (SQL) User Credentials Disclosure Exploit
Exploit for unknown platform in category web applications ===================================================== Stash 1.0.3 SQL User Credentials Disclosure Exploit ===================================================== !/usr/bin/perl -w User credentials disclosure exploit - stash103exp.pl This...
major_rls54.txt
MajorSecurity Advisory 54xt:Commerce - Cross Site Scripting and Session Fixation Issues Details ======= Product: xt:Commerce Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.xtcommerce-shop.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered...
major_rls53.txt
MajorSecurity Advisory 53BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues Details ======= Product: BLUEPAGE CMS Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.bluepage-cms.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...
Unfixed XSS vulnerability at www.metalis.fr
Security researcher k a n u r, has submitted on 07/11/2008 a cross-site-scripting XSS vulnerability affecting www.metalis.fr, which at the time of submission ranked 25144044 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/07/2009. It is...
Session fixation
Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...
CVE-2008-2970
CVE-2008-2970 describes multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) versions 1.4.3.1 and 1.4.2.8 and earlier. The issue allows remote attackers to hijack user sessions by supplying a crafted PHPSESSID value targeted at index.php and login.php within the homepg/ dir...
ccleaguepro-auth.txt
-+================================================================================+- -+ CCLeague Pro = 1.2 Insecure Cookie Authentication Vulnerability +- -+================================================================================+- Discovered By: t0pP8uZz Discovered On: 19 JUNE 2008 Scrip...
CCLeague Pro <= 1.2 Insecure Cookie Authentication Vulnerability
No description provided by source. -+================================================================================+- -+ CCLeague Pro = 1.2 Insecure Cookie Authentication Vulnerability +- -+================================================================================+- Discovered By: t0pP8uZ...
CCLeague Pro 1.2 - Insecure Cookie Authentication
-+================================================================================+- -+ CCLeague Pro = 1.2 Insecure Cookie Authentication Vulnerability +- -+================================================================================+- Discovered By: t0pP8uZz Discovered On: 19 JUNE 2008 Scrip...
ThaiQuickCart 3 - sLanguage Cookie Local File Inclusion
ThaiQuickCart 3 - sLanguage Cookie Local File Inclusion ===================================================================== ThaiQuickCart COOKIE:sLanguage Local File Inclusion Vulnerability =====================================================================...
CVE-2008-1500
Cross-site scripting XSS vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-1500
CVE-2008-1500 is an XSS vulnerability in TinyPortal, affecting versions 0.8.6 and 1.0.3, where the PHPSESSID parameter in index.php can be abused to inject arbitrary script/HTML. The entry states the issue originates from third‑party information and provides CVSSv2 metrics from NVD: AV:N/AC:M/Au:...
CVE-2008-1500
Cross-site scripting XSS vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Improper access control
phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values in files under tmp/, and then hijack sessions via PHPSESSID cookies...
Unfixed XSS vulnerability at www.diariofuengirola.com
Security researcher Norehem, has submitted on 08/08/2007 a cross-site-scripting XSS vulnerability affecting www.diariofuengirola.com, which at the time of submission ranked 4981203 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/08/2007. It ...