Pentacle In-Out Board <= 6.03 (login.asp) Remote Auth Bypass

Exploit for unknown platform in category web applications ============================================================ Pentacle In-Out Board Pentacle In-Out Board function ptxpl ifdocument.xpl.victim.value=="" alert"Please enter site!"; return false; ifconfirm"Are you sure?"...

Cisco IOS AAA RADIUS Long Username Authentication Bypass (CSCee45312)

The remote host is a CISCO router containing a version of IOS that contains a faulty RADIUS implementation which may lead to an authentication bypass vulnerability. An attacker may exploit this problem to gain unauthorized access to the service. C Tenable Network Security, Inc. include"compat.inc...

CVE-2006-0424

CVE-2006-0424 affects BEA WebLogic Server and WebLogic Express, specifically versions 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7. The vulnerability permits remote authenticated guest users to read the server log and obtain sensitive configuration information. The available connected so...

CVE-2005-4740

IBM DB2 Universal Database UDB 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service db2jd service crash by "connecting from a downlevel client."...

CVE-2005-4800

Direct static code injection vulnerability in Yet Another PHP Image Gallery YaPIG 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a modinfo action to modifygallery.php, which inserts the code into guidinfo.php. NOTE: this...

CVE-2005-4851

eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields and read these objects...

CVE-2004-2565

Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administrative IP address restrictions have been modified from the default, allow remote authenticated users to read arbitrary files via 1 a ".." dot dot backslash i...

CVE-2004-2553

The CVE-2004-2553 issue affects IgnitionServer ignitionServer 0.1.2 through 0.1.2-R2. A remote authenticated user with local IRC operator privileges can escalate to a global IRC operator by issuing the unofficial umode command with the +ORD argument. This privilege escalation is validated by mult...

CVE-2002-2163

KvPoll 1.1 allows remote authenticated users to vote more than once by setting the "alreadyvoted" cookie by various methods, including a direct call to clearcookies.php...

CVE-2002-2163

CVE-2002-2163 affects KvPoll 1.1. The vulnerability allows remote authenticated users to vote multiple times by manipulating the already_voted cookie, including through a direct call to clear_cookies.php. The connected documents do not provide exploitation specifics beyond this cookie-based bypas...

CVE-2005-3642

IBM Informix Dynamic Database server running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username...

CVE-2005-2963

The modauthshadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security...

CVE-2005-2770

The issue CVE-2005-2770 affects AttachmateWRQ Reflection for Secure IT Server before 6.0 Build 24. The vulnerability stems from a Renamed Account Remote Login flaw where valid public keys continue to allow Administrator or Guest logins after those accounts have been renamed or disabled post-authe...

CVE-2004-2481

CVE-2004-2481 affects MyProxy 6.58. The vulnerability allows remote authenticated users in the Users Tab to connect to arbitrary hosts from the MyProxy server by issuing a CONNECT command, bypassing access restrictions. No explicit exploit code or affected version range beyond 6.58 is provided in...

CVE-2005-1981

CVE-2005-1981 refers to a denial-of-service vulnerability in the Kerberos handling of Windows 2000 Server and Windows Server 2003 domain controllers (CAN-2005-1981). The issue allows a remote, authenticated attacker to send a crafted Kerberos message that can cause the domain controller’s authent...

CVE-2005-2219

CVE-2005-2219 affects Hosting Controller 6.1 Hotfix 2.1. Remote authenticated users can perform unauthorized actions by sending a direct request to AccountActions.asp and modifying the CreditLimit parameter in the UpdateCreditLimit action, enabling changes to user credit limits. The linked Red Ha...

CVE-2004-2169

CVE-2004-2169 affects Application Access Server (A-A-S) 1.0.37 and earlier. Remote authenticated users can trigger a denial of service (application crash) by issuing a long file request. No remediation or fixes are detailed in the provided documents.

CVE-2002-1821

Affected software: Ultimate PHP Board (UPB) 1.0 and 1.0b. Vulnerability: Remote authenticated users can gain privileges and perform unauthorized actions by making direct requests to specific admin pages: admin_members.php, admin_config.php, admin_cat.php, and admin_forum.php. Root cause/impact: T...

CVE-2002-1830

Open Bulletin Board (OpenBB) 1.0.0 RC3 contains an authentication bypass vulnerability that lets remote attackers access modifier options by issuing a direct request to moderator.php with action and ismod parameters. The vulnerability path arises from insufficient access controls on moderator.php...

security flaw

SQL injection vulnerability in the radiusxlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via 1 groupmembershipquery, 2 simulcountquery, or 3 simulverifyquery configuration entries...