6362 matches found
Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS
Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS ======================================================================== Software: Affiliate Network Pro v7.2 Severity: SQL Injections, Arbitrary code execution, XSS Risk: High Author: Robin Verton [email protected] Date:...
XOOPS xoopsConfig[language] Parameter Local File Inclusion (XOOPS_WFd205_xpl)
The remote installation of XOOPS fails to sanitize user-supplied input to the 'xoopsConfiglanguage' parameter of several xoopseditor scripts before using it in PHP 'include' functions. An unauthenticated attacker may be able to leverage these issues to read arbitrary local files and even execute...
CodeGrrl Applications Remote File Inclusion Vulnerabilities
The remote host appears to be running at least one of the PHP applications from CodeGrrl - PHPCalendar, PHPClique, PHPFanBase, or PHPQuotes. Under certain conditions, these applications fail to sanitize input to the 'siteurl' parameter of the 'protection.php' script before using it in a PHP...
PHPCalendar.txt
PHPCalendar and some more codegrrl.com products arbitrary code execution ========================================================================== Software: PHPCalendar, PHPClique, PHPFanBase, PHPCurrently, PHPQuotes Severity: Arbitrary code execution Risk: High Author: Robin Verton Date: Sep. 2...
security flaw
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when registerglobals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field...
security flaw
The parsestr function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the registerglobals directive via inputs that cause a request to be terminated due to the memorylimit setting, which causes PHP to set an internal flag that...
Fedora Core 3 : libungif-4.1.3-1.fc3.2 (2005-1045)
The libungif package contains a shared library of functions for loading and saving GIF format image files. The libungif library can load any GIF file, but it will save GIFs only in uncompressed format; it will not use the patented LZW compression used to save 'normal' compressed GIF files. A bug...
Fedora Core 4 : libungif-4.1.3-3.fc4.2 (2005-1046)
The libungif package contains a shared library of functions for loading and saving GIF format image files. The libungif library can load any GIF file, but it will save GIFs only in uncompressed format; it will not use the patented LZW compression used to save 'normal' compressed GIF files. A bug...
vBulletin < 3.0.5 'init.php' Unspecified Vulnerability
It is reported that versions 3.0.0 through to 3.0.4 of vBulletin are prone to a security flaw in SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
DEBIAN-CVE-2005-3300
The registerglobals emulation layer in grabglobals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use...
Net Portal Dynamic System 5.0 - Register Users Denial of Service
Net Portal Dynamic System 5.0 - Register Users Denial of Service !/usr/bin/perl Type|+ Register multiple users for Denial of Service Vendor url|+ www.npds.org Little description|+ NPDS Net Portal Dynamic System is a Frenchand now English ! GNU dynamic portal Solution|+ None official but you can a...
Net Portal Dynamic System 5.0 - Register Users Denial of Service
!/usr/bin/perl Type|+ Register multiple users for Denial of Service Vendor url|+ www.npds.org Little description|+ NPDS Net Portal Dynamic System is a Frenchand now English ! GNU dynamic portal Solution|+ None official but you can add a visual confirmation if you like php ; Worked on|+ Last...
[KAPDA::#6] Punbb SQL Injection Vulnerability
KAPDA::6 Punbb SQL Injection Vulnerability Punbb search.php SQL Injection Vulnerability KAPDA New advisory Vulnerable products : Punbb V 1.2.8 and 1.2.7 are tested,Hopefully all other versions Vendor: http://www.punbb.org/ Vulnerability: Sql injection About Punbb -------------------- PunBB is a...
PHP Advanced Transfer Manager <= 1.30 Multiple Vulnerabilities
The version of PHP Advanced Transfer Manager on the remote host suffers from multiple information disclosure and cross-site scripting flaws. For example, by calling a text or HTML viewer directly, an unauthenticated attacker can view arbitrary files, provided PHP's 'registerglobals' setting is...
PHPNuke78.txt
NewAngels Advisory 7PHP Nuke sqlquery"SELECT active, view FROM ".$prefix."modules WHERE title='$name'"; The $name variable is not checked so you could inject malicious SQL Code. In an file which is included whe have the following code: $queryString = strtolower$SERVER'QUERYSTRING'; if...
[SA16365] Chipmunk Forum "fontcolor" Cross-Site Scripting Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
Call+4 Dword XOR Encoder
Call+4 Dword XOR Encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Call+4 Dword XOR Encoder', 'Description' = 'Call+4 Dword XOR Encoder', 'Author' = 'hdm', 'spoonm' , 'Arch' = ARCHX86,...
osTicket < 1.3.1 Multiple Vulnerabilities
Binary data 3046.prm...
CVE-2005-0870
Multiple cross-site scripting XSS vulnerabilities in phpSysInfo 2.3, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 sensorprogram parameter to index.php, 2 textlanguage, 3 texttemplate, or 4 hidepicklist parameter to systemfooter.php...
DEBIAN-CVE-2005-0870
Multiple cross-site scripting XSS vulnerabilities in phpSysInfo 2.3, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 sensorprogram parameter to index.php, 2 textlanguage, 3 texttemplate, or 4 hidepicklist parameter to systemfooter.php...