NOCC Webmail <= 1.0 multiple vulnerabilities

------ NOCC Webmail = 1.0 multiple arbitrary local inclusion + ---------------- php injection - remote code execution / / cross site scripting / path disclosure -------------------------------------------------------------------------------- software: site: http://nocc.sourceforge.net/ descriptio...

[KAPDA::#29]Noah's classifieds multiple vulnerabilities

KAPDA New advisory Vendor: http://classifieds.phpoutsourcing.com Vulnerable: Noahs classifieds 1.3 and below classifieds component for mambo also may be affected Bug: Path Disclosure,Sql Injection,XSS,Local file inclusion,Remote code execution Exploitation: Remote with browser Exploit:available...

Invision Power Board 2.1.4 Multiple Vulnerabilities

/ -------------------------------------------------------- Neo Security Team NSTВ® - Advisory 16 - 18/02/06 -------------------------------------------------------- Program: Invision Power Board 2.1.4 Homepage: http://www.invisionboard.com Vulnerable Versions: 2.1.4 & Lower versions Risk: Low...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis DFMSA, as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involvin...

CVE-2006-0727

CVE-2006-0727 describes a SQL injection in mstrack.php of MusOX DF MSAnalysis (DFMSA), used with CPG-Nuke Dragonfly CMS. An attacker can trigger path disclosure via a SQL syntax error and may be able to execute arbitrary SQL commands. The affected software is MusOX DF MSAnalysis as used in Dragon...

dotproject <= 2.0.1 remote code execution

dotproject = 2.0.1 remote code execution ====================================== Software: dotProject = 2.0.1 Severity: Arbitrary code execution, Path/Information Disclosure Risk: High Author: Robin Verton [email protected] Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProje...

dotProject-2.0.1.txt

dotproject Date: Feb. 14 2006 Vendor: dotproject.net contacted Description: dotProject is a volunteer supported Project Management application. Details: The 'protection.php' script does not properly validate user-supplied input in the 'siteurl' parameter. Some user-supplied input is not checked...

CVE-2006-0660

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Directory traversal

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

Path traversal

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0590

MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax...

CVE-2006-0589

MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message...

CVE-2006-0590

The CVE-2006-0590 entry affects MyTopix 1.2.3, where a malformed hl parameter sent to index.php allows remote attackers to disclose the installation path. The underlying issue is described as path disclosure, with a note that it might be related to invalid SQL syntax. Public references in the rec...

kapda-26.txt

KAPDA New advisory Vendor: http://www.jaia-interactive.com Vulnerable: Version: 1.2.3 Bug: Sql Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- MyTopix is a PHP-based message board system that uses a MySQL database. Vulnerability: -------------------...

[KAPDA::#26] - MyTopix Sql Injection & Path Disclosure

KAPDA New advisory Vendor: http://www.jaia-interactive.com Vulnerable: Version: 1.2.3 Bug: Sql Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- MyTopix is a PHP-based message board system that uses a MySQL database. Vulnerability: -------------------...