CVE-2006-6007

The CVE-2006-6007 issue affects WebEvents (Online Event Registration Template) 2.0 and earlier, specifically save_profile.asp. The underlying flaw allows remote attackers to change profiles, passwords, and other information for arbitrary users by altering the UserID parameter. This describes a us...

PT-2006-6664 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 2.0.5 Description: The issue allows remote authenticated users to cause a denial of service, resulting in an application crash. This occurs when a string representation of a serialized object is not properly stored...

SmartDefense Profiles Available for Users of VPN-1 NGX R62: Assigning a Profile per Gateway

The most significant enhancement in the NGX R62 release is the enablement of SmartDefense Profiles. SmartDefense Profiles expand the flexibility and granularity of security defenses, while allowing central control and management of the security infrastructure. By defining multiple SmartDefense...

Debian DSA-958-1 : drupal - several vulnerabilities

Several security related problems have been discovered in drupal, a fully-featured content management/discussion engine. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3973 Several cross-site scripting vulnerabilities allow remote attackers ...

osDate 1.1.7 multiple vulnerabilities

/ osDate 1.1.7 advisory / Date of written Advisory: ------------------------- July, 18 2006 Product: -------- OSdate = 1.1.7 Vendor: ------- http://tufat.com/ Description: ------------ osDate is a full fledged dating script which can be eaily integrated with phpBB and flashChat, and provides...

Cybersocieties.txt

Cybersocieties.com Homepage: http://www.cybersocieties.com Effected files: Input boxes in profile: - Full name box - Occupation box - MSN box - Yahoo box - AIM Box Viewing a profile ------------------------------------------------------ XSS vuln via input boxes in profile: No filter evasion is...

Dragons Kingdom v1.0 - XSS & cookie disclosure

Dragons Kingdom Script v1.0 Homepage: http://www.dkscript.com/ Affected files: Sending mail: - Sending in-game mail Character Profiles: - All input boxes of the profile Posting & Replying in the forum: - Posting in the forum - Replying in the forum Form spoofing can occur in: - Profile input boxe...

PassMasterFlex (and PassMasterFlex+) XSS injection

PassMasterFlex and PassMasterFlex+ XSS injection Discovered by: Nomenumbra Date: 5/4/2006 impact:moderate privilege escalation,possible defacement PassMasterFlex+ is a database-driven multiple login that utilizes cookies for authentication. PassMasterFlex+ was written not only to provide an...

CVE-2006-1829

EAServer Manager in Sybase EAServer 5.2 and 5.3 allows remote authenticated users, possibly guests, to obtain password credentials of arbitrary users via unspecified vectors involving 1 connection caches, 2 open password prompts, and 3 stored custom connection profiles...

[Full-disclosure] BetaBoard Cross Site Scripting vulnerability

//----- Advisory Program : BetaBoard Homepage : http://gonzo.uni-weimar.de/scheffl2/betaboard/ Tested version : 0.1 Found by : Simon MOREL philemon at thehackademy dot net This advisory : Simon MOREL philemon at thehackademy dot net Discovery date : 2006/04/16 //----- Application description...

Information disclosure

NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to 1 the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and 2 the tmp directory, which lists names of uploaded attachments...

CVE-2006-0893

NOCC Webmail 1.0 is affected by an information-disclosure vulnerability where remote attackers can obtain sensitive data by directly requesting files in (1) the profiles directory (exposing e-mail addresses from profile filenames) and (2) the tmp directory (revealing uploaded attachment names). T...

CVE-2006-0893

NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to 1 the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and 2 the tmp directory, which lists names of uploaded attachments...

CVE-2006-0893: Undefined Security Weakness

NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to 1 the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and 2 the tmp directory, which lists names of uploaded attachments...

CVE-2005-4286

Unspecified vulnerability in PhpLogCon before 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving "'smart' values for userid and password," probably involving an SQL injection vulnerability in the 1 pass and 2 usr parameters in submit.php...

CVE-2005-4286

The CVE-2005-4286 entry concerns PhpLogCon prior to 1.2.2. It describes an unspecified vulnerability that could allow remote attackers to use arbitrary profiles via unknown vectors, likely stemming from an SQL injection in submit.php affecting the pass and usr parameters. The available documents ...

CVE-2005-4286

Unspecified vulnerability in PhpLogCon before 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving "'smart' values for userid and password," probably involving an SQL injection vulnerability in the 1 pass and 2 usr parameters in submit.php...

CVE-2005-3974

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission...

CVE-2005-3974: Undefined Security Weakness

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission...

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

Andrew Widdowson informed us that it's possible to bypass the 'access user profile' permission if the server is running PHP5. No data can be changed though. Versions affected Drupal 4.6.0, 4.6.1, 4.6.2, 4.6.3 Solution If you are running Drupal 4.6.x and PHP5, then upgrade to Drupal 4.6.4...