CVE-2006-6288

Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via 1 a playlist file with long song names, because of an overflow in the CPLAddPrefixedFile function in CPIPlaylist.c; 2 a skin file with long button names, because of an overflow...

CVE-2006-6288

Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via 1 a playlist file with long song names, because of an overflow in the CPLAddPrefixedFile function in CPIPlaylist.c; 2 a skin file with long button names, because of an overflow...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6278

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-6288

CVE-2006-6288 affects CoolPlayer 216 and earlier. The vulnerability consists of multiple buffer overflows in CPL_AddPrefixedFile (playlist names), main_skin_check_ini_value (skin button names), and main_skin_open (skin bitmap filenames) in CPI_Playlist.c and skin.c, allowing remote attackers to e...

CVE-2006-6288

Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via 1 a playlist file with long song names, because of an overflow in the CPLAddPrefixedFile function in CPIPlaylist.c; 2 a skin file with long button names, because of an overflow...

CVE-2006-6279

Vulnerability CVE-2006-6279 affects @lex Guestbook 4.0.1. The issue occurs in index.php where a skin parameter referencing a nonexistent skin causes an error message that reveals the installation path, enabling information disclosure to remote attackers. The NVD entry lists this as a medium-sever...

CVE-2006-6278

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

CVE-2006-6279

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6279: Undefined Security Weakness

index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message...

CVE-2006-6278: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...

Hack tricks with QQ skin to do a backdoor invasion-vulnerability warning-the black bar safety net

A few days ago lcx prompted to say and QQ overflow vulnerability, and then suddenly the reminders I used to have a few QQ. vbs file didn't seriously go read it. So into the directory looking for it, this look does not matter Ah, almost weighs that. The original We for QQ of operation is like this...

Comdev One Admin Pro path[docroot]及path[skin]参数文件包含漏洞

Comdev One Admin Pro是用于为数据库驱动的网站创建PHP模块的平台。 Comdev One Admin Pro的多个脚本在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 Comdev One Admin Pro的adminfoot.php、adminhead.php和adminlogin.php脚本没有正确地验证pathdocroot及pathskin参数的输入，允许攻击者通过包含本地或外部资源的文件导致执行任意PHP代码。漏洞相关的代码如下： ? include$path"docroot".$path"skin"...

PHPWIND1.3.6论坛skin变量未过滤导致管理员密码更改漏洞

PHPWIND论坛是一款流行的PHP论坛，界面美观，功能也比较强大。但大家仔细看一下会发现不论是从界面功能还是代码风格，它和DISCUZ都非常相似，具体原因我想也就不用说了，毕竟DISCUZ出来比它要早很多。但安全上它没有继承DISCUZ的优点，DISCUZ论坛安全性非常好，而且商家也对此非常重视安全问题，国内论坛中不论从功能还是安全,第一非DISCUZ莫属。PHPWIND虽然代码严谨，逻辑清楚，但还是有一些漏洞，而且还相当严重。 skin变量未过滤导致管理员密码更改 漏洞代码如下header.php： !functionexists'readover' &&...

NuralStorm Webmail <= 0.98b (process.php) Remote Include Vulnerability

No description provided by source. --------------------------------------------------------------------------- NuralStorm Webmail = 0.98b Remote File Include Vulnerability --------------------------------------------------------------------------- Discovered By Kw3RLn Romanian Security Team :...

CVE-2006-5281: Undefined Security Weakness

PHP remote file inclusion vulnerability in naboardpnr.php in n@board 3.1.9e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skin parameter...

seirCMS.txt

CR Advisory1 programm: Seir Anphin v666 Community Management System bug: SQL injection home page: www.comeplaydying.com bug found: 27.07.2006 discovered by CR www.svt.nukleon.us ! Details ! ============================================================================================ index.php...

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

Description Microsoft Windows Media Player is prone to a remote code-execution vulnerability. This vulnerability is related to handling of malicious PNG images. PNG images may be embedded in Windows Media Player skin files. Attackers may be able to exploit this issue by causing the application to...

CVE-2006-1384: Undefined Security Weakness

Cross-site scripting XSS vulnerability in apwcwinmain.jsp in the web console in IBM Tivoli Business Systems Manager TBSM before 3.1.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter...