mvnforum-jsxss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 mvnForum Cross Site Scripting Vulnerability Original release date: 2008-04-27 Last revised: 2008-05-06 Latest version: http://users.own-hero.net/decoder/advisories/mvnforum-jsxss.txt Source: Christian Holler Systems Affected: mvnForum 1.1...

CVE-2008-0709

Multiple unspecified vulnerabilities in HP Select Identity 4.00, 4.01, 4.11, 4.12, 4.13, and 4.20 allow remote authenticated users to access other user accounts via unknown vectors, a different issue than CVE-2008-0214...

DSA-1517-1 ldapscripts - information disclosure

Bulletin has no description...

CVE-2008-0724

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

CVE-2008-0724

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

The Everything Development System - SQL Injection

Application: The Everything Development System Versions: = Pre-1.0 current version at time of release Author: sub [email protected] Released: 2/1/2008 There exists a vulnerability in The Everything Development Engine that allows a user to inject their own SQL to modify a SELECT query, leading to...

2WIRE Routers - 'H04_POST' Access Validation

source: https://www.securityfocus.com/bid/27516/info Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions. Unauthenticated attackers can leverage this issue to change the password of arbitrary...

CVE-2008-0440

The affected software is AlstraSoft Forum Pay Per Post Exchange 2.0. The CVE entry describes the root cause as storing passwords in cleartext, enabling attackers to access user accounts. The connected documents confirm this issue, but do not provide a remediation or patch version. Exploitation st...

ImageAlbum 2.0.0b2 (id) Remote SQL Injection Vulnerability

No description provided by source. ImageAlbum Remote SQL Injection Vulnerabilities ------------------------------------------------------------------------- Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08 - Introduction...

ImageAlbum 2.0.0b2 (id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== ImageAlbum 2.0.0b2 id Remote SQL Injection Vulnerability ========================================================== ImageAlbum Remote SQL Injection Vulnerabilities...

ImageAlbum 2.0.0b2 - id SQL Injection

ImageAlbum 2.0.0b2 - id SQL Injection ImageAlbum Remote SQL Injection Vulnerabilities ------------------------------------------------------------------------- Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08 - Introduction...

imagealbum-sql.txt

ImageAlbum Remote SQL Injection Vulnerabilities ------------------------------------------------------------------------- Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08 - Introduction ImageAlbum is a web application written...

ImageAlbum 2.0.0b2 - 'id' SQL Injection

ImageAlbum Remote SQL Injection Vulnerabilities ------------------------------------------------------------------------- Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08 - Introduction ImageAlbum is a web application written...

Cross site request forgery (csrf)

Gadu-Gadu does not properly perform protocol handling, which allows remote attackers to conduct cross-site request forgery CSRF attacks and add arbitrary user accounts or cause a denial of service as administrators via an unspecified "crafted link," possibly related to the gg protocol...

Microsoft Internet Explorer mshtml.dll Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the user's account and possibly the underlying computer...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

Ubuntu 5.04 / 5.10 / 6.06 LTS : awstats vulnerability (USN-290-1)

Hendrik Weimer discovered a privilege escalation vulnerability in awstats. By supplying the 'configdir' CGI parameter and setting it to an attacker-controlled directory such as an FTP account, /tmp, or similar, an attacker could execute arbitrary shell commands with the privileges of the web serv...

CVE-2003-1350

List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" pipe, which is used as a field delimiter, into the bannerurl field...

CVE-2003-1350

CVE-2003-1350 affects List Site Pro 2.0. A remote attacker can hijack user accounts by inserting a pipe character into the bannerurl field, exploiting it as a delimiter. The available descriptions state this vulnerability condition but do not provide specifics on affected versions beyond List Sit...