CVE-2007-4779

Cross-site scripting XSS vulnerability in Joomla! 1.5 before RC2 aka Endeleo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the archive section...

CVE-2007-4779: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Joomla! 1.5 before RC2 aka Endeleo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the archive section...

CVE-2007-4777: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Joomla! 1.5 before RC2 aka Endeleo allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to the archive section. NOTE: this may be the same as CVE-2007-4778...

Joomla! 1.5 Beta1/Beta2/RC1 - SQL Injection

!/usr/bin/php -q -d shortopentag=on getPageParameters; switch $params-get'filtertype', 'title' case 'title' : $where .= ' AND LOWER a.title LIKE '%'.$filter.'%''; break; case 'author' : $where .= ' AND LOWER u.name LIKE '%'.$filter.'%' OR LOWER a.createdbyalias LIKE '%'.$filter.'%' '; break;...

Unfixed XSS vulnerability at www.unicycle.com

Security researcher KURDISHMOD, has submitted on 20/05/2007 a cross-site-scripting XSS vulnerability affecting www.unicycle.com, which at the time of submission ranked 220478 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/05/2007. It is...

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution / Fedora Core 6 exec-shield based Webdesproxy webdesproxy-0.0.1.tgz remote root exploit reverse connect-back method by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL:...

CVE-2007-2470: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 module, or 3 section parameter...

CVE-2007-1974

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

CVE-2007-1974

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

Sql injection

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

CVE-2007-1974

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

CVE-2007-1974

The CVE-2007-1974 entry describes an SQL injection in WF-Section (XOOPS WF-Section) 1.0.1, via the articleid parameter to print.php, affecting the getArticle function in class/wfsarticle.php. Affected component is the WF-Section XOOPS module; the vulnerability arises from inadequate input sanitiz...

CVE-2007-1974: Undefined Security Weakness

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

XOOPS WF-Section Module print.php articleid Parameter SQL Injection

The remote host is running the WF-Section module, a third-party module for XOOPS. The version of this module installed on the remote host fails to properly sanitize user-supplied input to the 'articleid' parameter of the 'modules/wfsection/print.php' script before using it to build a database...

XOOPS Module WF-Section <= 1.01 (articleid) SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================= XOOPS Module WF-Section : "; $dir = ; chop $dir; if $dir = /exit/ print "-- Exploit FailedYou Are Exited \n"; exit; if $dir = /// else print "-- Exploit FailedNo DIR \n";...

XOOPS Module WF-Section 1.01 - articleId SQL Injection

XOOPS Module WF-Section 1.01 - articleId SQL Injection !/usr/bin/perl Script Name: XOOPS Module WF-Section : "; $dir = ; chop $dir; if $dir = /exit/ print "-- Exploit FailedYou Are Exited \n"; exit; if $dir = /// else print "-- Exploit FailedNo DIR \n"; exit; print "User ID uid: "; $id = ; chop...

XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection

!/usr/bin/perl Script Name: XOOPS Module WF-Section : "; $dir = ; chop $dir; if $dir = /exit/ print "-- Exploit FailedYou Are Exited \n"; exit; if $dir = /// else print "-- Exploit FailedNo DIR \n"; exit; print "User ID uid: "; $id = ; chop $id; $target =...

libero-xss.txt

Libero.it, one of the most important italian ISP www.libero.it is affected from a XSS vulnerability. The vulnerability can be found in the "Community" section of Libero portal, and the affected functionality is "add nick" http://digiland.libero.it/profilo.phtml?nick=. The implementation of this...

oracle 10g (PROCESS_DUP_HANDLE) Local Privilege Elevation (win32)-vulnerability warning-the black bar safety net

include windows. h include stdio. h BOOL InjectShellcodeDWORD oldEIP,CHAR oSID HMODULE hKernel; FARPROC pCreateProc; LPSTR sCommand="cmd.exe"; DWORD dwStrLen; CHAR buff1 0 0; dwStrLen=strlensCommand; hKernel=LoadLibrary"Kernel32.dll"; pCreateProc=GetProcAddresshKernel,"CreateProcessA"; strcpybuff...

Unfixed XSS vulnerability at www.glooks.com

Security researcher MaXWeL, has submitted on 16/03/2007 a cross-site-scripting XSS vulnerability affecting www.glooks.com, which at the time of submission ranked 270567 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/03/2007. It is currently...