phpCOIN v1.2.2 XSS vuln.

phpCOIN v1.2.2 XSS vuln. Vuln. discovered by : r0t Date: 28 march 2006 vendor:http://www.phpcoin.com/ affected versions:V.1.2.2 and prior orginal advisory:http://pridels.blogspot.com/2006/03/phpcoin-v122-xss-vuln.html Vuln. Description: phpCOIN contains a flaw that allows a remote cross site...

GLSA-200509-16 : Mantis: XSS and SQL injection vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200509-16 Mantis: XSS and SQL injection vulnerabilities Mantis fails to properly sanitize untrusted input before using it. This leads to a SQL injection and several cross-site scripting vulnerabilities. Impact : An attacker could...

DUware DUforum 3.0/3.1 - 'forums.asp?iFor' SQL Injection

source: https://www.securityfocus.com/bid/14035/info DUforum is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application, access...

SRT2003-08-22-104 - Wireless Intrusion dection remote root compromise

Secure Network Operations, Inc. http://www.secnetops.com Strategic Reconnaissance Team [email protected] Team Lead Contact [email protected] Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS, Software Security Validation, and...

WIDZ 1.0/1.5 - Remote Code Execution

source: https://www.securityfocus.com/bid/8479/info WIDZ does not validate untrusted input when generating alerts. Alerts pass the essid of an unknown wireless access point through a system call. By setting the essid of an unauthorized access point to include malformed information, the underlying...

Progress Database 9.1 - Environment Variable Privilege Escalation

Progress Database 9.1 - Environment Variable Privilege Escalation // source: https://www.securityfocus.com/bid/7916/info It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen function used by several Progress...

Progress Database 9.1 - Environment Variable Privilege Escalation

// source: https://www.securityfocus.com/bid/7916/info It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen function used by several Progress utilities checks the user's PATH environment variable when includin...

mpg123 vulnerabilities

In 2003, two vulnerabilities were discovered in mpg123 that could result in remote code execution when using untrusted input or streaming from an untrusted server...

[SNS Advisory No.58] Microsoft IIS Local Cross-site Scripting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.58 Microsoft IIS Local Cross-site Scripting Vulnerability Problem first discovered: Tue, 28 May 2002 Published: Tue, 5 Nov 2002 Reference: http://www.lac.co.jp/security/intelligence/SNSAdvisory/58.html...

Gallery includedir Parameter Remote File Inclusion

The version of Gallery installed on the remote host is affected by a remote file inclusion vulnerability due to the application failing to properly sanitize user-supplied input to the 'includedir' parameter. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shel...

mIRC 6.0 - Scripting ASCTime Buffer Overflow

source: https://www.securityfocus.com/bid/5576/info mIRC is a chat client for the IRC protocol, designed for Microsoft Windows based operating systems. mIRC includes support for a scripting language. A buffer overflow vulnerability has been reported in the $asctime identifier, a function in the...

CVE-2000-0594

BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause a denial of service via an invite to a channel whose name includes special formatting characters...

CVE-2024-36361

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would...