3413 matches found
MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions
MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/30421/info The RSS plugin for miniBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attack...
Gregarius 0.5.4 - SQL Injection
GulfTech Security Research July 29, 2008 Vendor : Marco Bonetti URL : http://www.gregarius.net/ Version : Gregarius populate" noti.unread & ". RSSMODEUNREADSTATE ." and i.cid= $cid", "", 0, 2, ITEMSORTHINTREAD; $readItems - setTitleLBLH2RECENTITEMS; $readItems - setRenderOptionsILTITLENOESCAPE;...
MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions
source: https://www.securityfocus.com/bid/30421/info The RSS plugin for miniBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and the underlying...
[SECURITY] Fedora 8 Update: liferea-1.4.15-3.fc8
Liferea Linux Feed Reader is an RSS/RDF feed reader. It's intended to be a clone of the Windows-only FeedReader. It can be used to maintain a list of subscribed feeds, browse through their items, and show their contents...
[SECURITY] Fedora 8 Update: blam-1.8.3-17.fc8
Blam is a tool that helps you keep track of the growing number of news feeds distributed as RSS. Blam lets you subscribe to any number of feeds and provides an easy to use and clean interface to stay up to date...
fuzzylinecms-exec.txt
!/usr/bin/perl fuzzylime 3.0.1 Perl exploit discovered & written by Ams [email protected] DESCRIPTION: There are availability to load files through script rss.php, and also there are unfiltered extract; usage. This exploit creates shell in /code/counter/middleindexinc.php USAGE: Run exploit: perl...
DreamNews Manager - 'id' SQL Injection
dreamnews rss Remote SQL Injection Vulnerability ======================================================== Author: Hussin X = = Home : www.tryag.cc/cc = = email: darkangelg85atYahooDoTcom = = ========================================================= script : http://dreamlevels.com/dreamnews.php Do...
CVE-2008-3033
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...
Design/Logic Flaw
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...
CVE-2008-3034
Multiple SQL injection vulnerabilities in RSS-aggregator 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 IdFlux parameter to admin/fonctions/supprimerflux.php and the 2 IdTag parameter to admin/fonctions/supprimertag.php...
Sql injection
Multiple SQL injection vulnerabilities in RSS-aggregator 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 IdFlux parameter to admin/fonctions/supprimerflux.php and the 2 IdTag parameter to admin/fonctions/supprimertag.php...
CVE-2008-3034
Multiple SQL injection vulnerabilities in RSS-aggregator 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 IdFlux parameter to admin/fonctions/supprimerflux.php and the 2 IdTag parameter to admin/fonctions/supprimertag.php...
CVE-2008-3034
CVE-2008-3034 affects RSS-aggregator 1.0. The vulnerability is a SQL injection in two input points: the IdFlux parameter to admin/fonctions/supprimer_flux.php and the IdTag parameter to admin/fonctions/supprimer_tag.php. This allows remote attackers to execute arbitrary SQL commands. The availabl...
CVE-2008-3033
CVE-2008-3033 concerns RSS-aggregator 1.0 where the admin/fonctions/ directory does not require administrative authentication. This allows remote attackers to access admin functions (e.g., supprimer_flux.php and modifier_tps_rafraich.php) with unspecified additional impact. The provided documents...
CVE-2008-3033
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...
[SECURITY] Fedora 8 Update: liferea-1.4.15-2.fc8
Liferea Linux Feed Reader is an RSS/RDF feed reader. It's intended to be a clone of the Windows-only FeedReader. It can be used to maintain a list of subscribed feeds, browse through their items, and show their contents...
[SECURITY] Fedora 8 Update: blam-1.8.3-16.fc8
Blam is a tool that helps you keep track of the growing number of news feeds distributed as RSS. Blam lets you subscribe to any number of feeds and provides an easy to use and clean interface to stay up to date...
RSS-aggregator Multiple vulnerabilities
---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...
rssagg-sql.txt
---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...
RSS-aggregator SQL注入漏洞
BUGTRAQ ID: 30016 CNCAN ID：CNCAN-2008070102 RSS-aggregator是一款基于PHP的WEB应用程序。 RSS-aggregator不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 RSS-aggregator 1.0 目前没有详细解决方案提供： http://www.rss-aggregator.com/...