477 matches found
IlohaMail < 0.7.9 Attachment Upload Vulnerability
IlohaMail does not properly check the upload path for file attachments, which may allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted fro...
CVE-2005-3259
Multiple SQL injection vulnerabilities in versatileBulletinBoard vBB 1.0.0 RC2 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 login field, 2 "search this thread" feature, 3 "search for posts" feature, 4 "forgot password" feature, 5 list parameter in...
CVE-2005-2734
Cross-site scripting XSS vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag...
[SA16389] Gallery PostNuke Integration Security Issue
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
CVE-2001-1516
Affected software: phpReview, versions 0.9.0 rc2 and earlier. Vulnerability: Cross-site scripting (XSS) via user-submitted reviews, enabling remote attackers to inject arbitrary script/HTML. Root cause: inadequate input sanitization in the review submission pathway. Impact: not quantified beyond ...
FreeBSD : horde -- Horde Page Title XSS Vulnerability (396ee517-a607-11d9-ac72-000bdb1444a4)
Secunia Advisory: SA14730 A vulnerability has been reported in Horde, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed when setting the parent frame's page title via JavaScript is not properly sanitised before being returned to the user. This can be...
[Full-disclosure] Dokeos - Multiple Vulnerabilities
2 months ago we published an advisory about the Claroline application: http://www.zone-h.org/advisories/read/id=7472 Dokeos www.dokeos.com 1.5.5 has the same vulnerabilities than Claroline because it was based on it, but not all of them: there are 3 file inclusion vulnerabilities, and some of the...
CVE-2005-0961
Cross-site scripting XSS vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via the parent frame title...
CVE-2005-0615
PostNuke 0.760-RC2 is affected by multiple SQL injection vulnerabilities in index.php, modules.php, and admin.php via the catid parameter, enabling remote attackers to execute arbitrary SQL. The CVE entry CVE-2005-0615 maps to these flaws. OpenVAS/Nessus entries corroborate multiple SQL injection...
PostNuke Phoenix 0.7x - 'CATID' SQL Injection
source: https://www.securityfocus.com/bid/12683/info PostNuke Phoenix is reported prone to an SQL injection vulnerability. This issue arises due to insufficient sanitization of user-supplied input. It is reported that issue presents itself when malicious SQL syntax is issued to the application...
[SA13040] Caudium HTTP Request Processing Denial of Service
TITLE: Caudium HTTP Request Processing Denial of Service SECUNIA ADVISORY ID: SA13040 VERIFY ADVISORY: http://secunia.com/advisories/13040/ CRITICAL: Moderately critical IMPACT: DoS WHERE: From remote SOFTWARE: Caudium 1.x http://secunia.com/product/4196/ DESCRIPTION: A vulnerability has been...
TorrentTrader 1.0 RC2 - SQL Injection
TorrentTrader 1.0 RC2 - SQL Injection !/usr/bin/php ? / TorrentTrader 1.0 RC2 SQL Injection Proof of Concept By aCiDBiTS acidbitsathotmail.com 31-August-2004 "TorrentTrader http://www.torrenttrader.com/ is a feature packed and highly customisable open-source BitTorrent tracker." This PoC dumps th...
[UNIX] FreznoShop Cross Site Scripting Vulnerability (search.php)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
CVE-2002-0524
The CVE-2002-0524 entry affects ASP-Nuke RC2 and earlier . The vulnerability arises from error messages that disclose the server’s absolute path when attackers trigger two conditions: (1) calling database-inc.asp with incorrect cookies, or (2) calling Post.asp with certain arguments. This results...
CVE-2002-0522
ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the "pseudo" cookie. The flaw is in how ASP-Nuke uses cookies for authentication, enabling cookie tampering to impersonate other users (including admin). Vendor patch status is not provided ...
CVE-2002-0523
ASP-Nuke RC2 and earlier are affected by an information disclosure vulnerability where an attacker can locally modify the user cookie and submit it to cause the server to reveal the list of currently logged-in users (or show the web root path in an error). Affected component: ASP-Nuke RC1–RC2 (co...
CVE-2002-0521
ASP-Nuke RC2 and earlier are affected by a cross-site scripting (XSS) vulnerability. The issue arises in multiple input points: downloads.asp (name parameter), Post.asp (message parameter), and profile.asp (web site URL), allowing remote attackers to execute script in a user’s browser and potenti...