TaskFreak! 0.6.4 - Multiple Cross-Site Scripting Vulnerabilities

TaskFreak! v0.6.4 Multiple Cross-Site Scripting Vulnerabilities Vendor: Stan Ozier Product web page: http://www.taskfreak.com Affected version: 0.6.4 multi-user Summary: TaskFreak! Original is a simple but efficient web based task manager written in PHP. Desc: TaskFreak! suffers from multiple XSS...

CVE-2010-3713

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

Design/Logic Flaw

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

CVE-2010-3713

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

CVE-2010-3713: Undefined Security Weakness

rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed...

CVE-2009-4973

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action...

Sql injection

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action...

CVE-2009-4973

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action...

CVE-2009-4973

TotalCalendar 2.4 is affected by a SQL injection in rss.php, exploitable via the selectedCal parameter in a SwitchCal action. The vulnerability allows remote attackers to execute arbitrary SQL commands. CVSS v2 base score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P). Referenced exploit appears at Exploit-DB ...

CVE-2009-4973: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action...

CVE-2010-1186: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter...

CVE-2010-1093

SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action...

CVE-2010-1093

CVE-2010-1093 details (MODE C): Affected product: 1024 CMS 2.1.1. The vulnerability is a SQL injection in rss.php when magic_quotes_gpc is disabled, allowing remote attackers to execute arbitrary SQL commands via the id parameter in a vp action. This is the explicit root cause described in connec...

CVE-2010-1093

SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action...

CVE-2010-1093: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action...

Thelia 1.4.2.1 Cross Site Scripting

Exploit Title: Thelia Date: 17/01/2010 Author: EsSandRe Software Link: http://www.thelia.fr/fichiers/thelia1.4.2.1.zip Version: 1.4.2.1 Tested on: / Vulnérabilité XSS au niveau de la variable 'motcle' de type POST http://localhost/recherche.php Une deuxième au niveau de la variable "ref" dans le...

Bitrix Site Manager Remote File Inclusion

Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just write this exploit under perl module...

Bitrix Site Manager Multiple Remote File Include Vulnerability

No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to 1 Calendar.php, 2 Comment.php, 3 Rss.php and 4 Trackback.php in lib/Loggix/Module/; and 5...

Loggix Project <= 9.4.5 Multiple Remote File Inclusion Vulnerabilities

No description provided by source. In The Name Of Allah Loggix Project = 9.4.5 Multiple Remote File Include Vulnerability Download Script : http://sourceforge.net/projects/loggix/files/ Author : cr4wl3r Contact : cr4wl3r4tlinuxmaildotorg Location : Gorontalo - INDONESIA Blog :...