MOSEB-12 Bonus: Vulnerability in AltaVista

MOSEB-12 Bonus: Vulnerability in AltaVista 22:40 12.06.2007 New bonus vulnerability in AltaVista. In this case vulnerability not directly at AltaVista’s site, like at MOSEB-12: Vulnerabilities at www.altavista.com, but in local search engine made by AltaVista. The hole are in AltaVista local sear...

CVE-2007-3484

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

Cross site scripting

Cross-site scripting XSS vulnerability in AltaVista search engine allows remote attackers to inject arbitrary web script or HTML via the text parameter to the default URI...

CVE-2007-3484

CVE-2007-3484 describes an XSS vulnerability in Google Custom Search Engine, where the q parameter in the search functionality is susceptible to script injection. The affected component is the search flow of Google Custom Search Engine (claims reference to a non-existent search.php script; Google...

CVE-2007-3484: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

CVE-2006-7209

Multiple cross-site scripting XSS vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the 1 main, 2 daily, 3 weekly, 4 monthly, 5 new trends, 6 individual page, and 7 search engine...

Design/Logic Flaw

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

CVE-2007-2988

The CVE-2007-2988 entry describes a vulnerability in the Inout Meta Search Engine: an admin script redirects the browser but does not exit when admin credentials are missing, enabling remote attackers to inject arbitrary PHP code via a sequence of requests to admin/create_engine.php and then admi...

CVE-2007-2988

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

CVE-2007-2979

Techno Dreams Web Directory / Search Engine 2.0 is affected by an improper access control vulnerability: sensitive data stored under the web root (Database.mdb) can be downloaded via a direct request. This CVE entry is corroborated across NVD/related records; the root cause is insufficient access...

CVE-2007-2988: Undefined Security Weakness

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/createengine.php followed by a request to...

CVE-2007-2979: Undefined Security Weakness

Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb...

wdse20-db.txt

--/ INTRODUCTION -- Advisory : Web Directory / Search Engine v2.0 Authentication Bypass/Database Download Vulnerability Release Date : 25 / 05 / 2007 Application : Web Directory / Search Engine v2.0 Impact : Remote Googledork : "Web Directory / Search Engine v2.0" ,...

inoutse-exec.txt

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc this is not a protection for two reasons: i everyone can make a cookie with false credentials ii there isn't any exit or die function after header'Location: index.php' Now look at create...

Inout Search Engine - Remote Code Execution

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc this is not a protection for two reasons: i everyone can make a cookie with false credentials ii there isn't any exit or die function after header'Location: index.php' Now look at create...

Inout Search Engine (all version) Remote Code Execution Exploit

Exploit for unknown platform in category web applications =============================================================== Inout Search Engine all version Remote Code Execution Exploit =============================================================== !/usr/bin/php -q -d shortopentag=on this is not a...

Inout Search Engine (all version) Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " Inout Search Engine all version Remote Code Execution Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love "; if $argc3 echo "Usage: php...

Web Directory / Search Engine v2.0 Authentication Bypass/Database Download Vulne

--/ INTRODUCTION -- Advisory : Web Directory / Search Engine v2.0 Authentication Bypass/Database Download Vulnerability Release Date : 25 / 05 / 2007 Application : Web Directory / Search Engine v2.0 Impact : Remote Googledork : "Web Directory / Search Engine v2.0" ,...

sinecms-xss.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-26 ISO 8601 Product : SineCms Version : 2.3.4 last, prior versions may also be affected Vendor : http://sourceforge.net/projects/sine - http://www.sinecms.net Vendor Status : 2007-04-26 - Informed! Description : SineCms is a management...