CVE-2006-0044

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...

Design/Logic Flaw

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields"...

[SECURITY] [DSA 942-1] New albatross packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 942-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

DSA-942-1 albatross - design error

Bulletin has no description...

CVE-2006-0202

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

Code injection

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

CVE-2006-0202

CVE-2006-0202 affects PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier. The issue is due to insecure filesystem permissions: ipn/logs/ipn_success.txt is world-readable, allowing local users to view payment data, and ipn/logs is world-writable, enabling local users to delete or repl...

CVE-2006-0201

The provided connected documents confirm CVE-2006-0201 affects PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier versions. The vulnerability allows remote attackers to inject false payment entries into the log file by sending HTTP POST requests to ipn_success.php, indicating an inpu...

CVE-2006-0202

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

Multiple PHP Toolkit for PayPal Vulnerabilities

Vendor: Patrick Breitenbach and Dave Nielsen http://paypal.sf.net/ Versions affected: PHP Toolkit for PayPal v0.50 and may be prior Date: 12th January 2006 Type of Vulnerability: Sensitive Information Disclosure and Payment System Bypass Severity: Critical Solution Status: Unpatched Vendor was...

CVE-2005-4812

The SISCO OSI stack for Windows, as used by MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and the ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service process crash via certain network traffic, as demonstrated usi...

CVE-2005-4196

Multiple cross-site scripting XSS vulnerabilities in Scout Portal Toolkit SPT 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the ss parameter in SPT--QuickSearch.php; 2 ParentId parameter in SPT--BrowseResources.php; 3 the ResourceId parameter in...

CVE-2005-4195

Multiple SQL injection vulnerabilities in Scout Portal Toolkit SPT 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the ParentId parameter in SPT--BrowseResources.php, 2 ResourceId parameter in SPT--FullRecord.php, 3 ResourceOffset parameter in SPT--Home.php, and 4...

CVE-2005-4195

CVE-2005-4195 describes multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) versions up to 1.3.1 (and note that vector 1 was reportedly present in 1.4.0). The affected entry lists five input points: (1) ParentId in SPT--BrowseResources.php, (2) ResourceId in SPT--FullRecord.php, ...

CVE-2005-4196

CVE-2005-4196 affects Scout Portal Toolkit (SPT) 1.3.1 and earlier. The issue is multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via numerous parameters (e.g., ss in QuickSearch, ParentId in BrowseResources, ResourceId in Full...

CVE-2005-4195

Multiple SQL injection vulnerabilities in Scout Portal Toolkit SPT 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the ParentId parameter in SPT--BrowseResources.php, 2 ResourceId parameter in SPT--FullRecord.php, 3 ResourceOffset parameter in SPT--Home.php, and 4...

Scout Portal Toolkit 1.3.1 - SPT-QuickSearch.php Cross-Site Scripting

Scout Portal Toolkit 1.3.1 - SPT-QuickSearch.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could...

Scout Portal Toolkit 1.3.1 - SPT-AdvancedSearch.php Cross-Site Scripting

Scout Portal Toolkit 1.3.1 - SPT-AdvancedSearch.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit cou...

Scout Portal Toolkit 1.3.1 - SPT-UserLogin.php SQL Injection

Scout Portal Toolkit 1.3.1 - SPT-UserLogin.php SQL Injection source: https://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an...

Scout Portal Toolkit 1.3.1 - SPT-BrowseResources.php Cross-Site Scripting

Scout Portal Toolkit 1.3.1 - SPT-BrowseResources.php Cross-Site Scripting source: https://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit...