2627 matches found
GNU Mailman 2.1 - email Cross-Site Scripting
GNU Mailman 2.1 - email Cross-Site Scripting source: https://www.securityfocus.com/bid/6677/info A vulnerability has been discovered in GNU Mailman. It has been reported that Mailman is prone to cross site scripting attacks. This is due to insufficient santization of URI parameters. As a result,...
CVE-2002-1188
Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name...
CVE-2002-0963
SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter...
MidiCart Shopping Cart Software database vulnerability
Summary MIDICART is s an ASP and PHP based shopping Cart application with MS Access and SQL database. A security vulnerability in the product allows remote attackers to download the product's database, thus gain access to sensitive information about users of the product name, surname, address,...
CVE-2002-0343
Hotline Client 1.8.5 stores sensitive user information, including passwords, in plaintext in the bookmarks file, which could allow local users with access to the bookmarks file to gain privileges by extracting the passwords...
CVE-2002-0523
ASP-Nuke RC2 and earlier are affected by an information disclosure vulnerability where an attacker can locally modify the user cookie and submit it to cause the server to reveal the list of currently logged-in users (or show the web root path in an error). Affected component: ASP-Nuke RC1–RC2 (co...
[ARL02-A12] PHP(Reactor) Cross Site Scripting Vulnerability
+/---------------- ALPER Research Labs ------/--------/+ +/---------------- Security Advisory -----/---------/+ +/---------------- ID: ARL02-A12 ----/----------/+ +/---------------- [email protected] ---/-----------/+ Advisory Information -------------------- Name : phpReactor Cross Site Scripti...
CVE-2002-0257
Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields 1 TITLE, 2 DESCTIT, 3 DESC, 4 searchstring, 5 ALIAS, 6 EMAIL, 7 ADDRESS1, 8 ADDRESS2, 9 ADDRESS3, 10 PHONE1, 11 PHONE2, 12 PHONE3, or ...
CVE-2001-1281
Web Messaging Server for Ipswitch IMail 7.04 and earlier allows remote authenticated users to change information for other users by modifying the olduser parameter in the "Change User Information" web form...
CVE-2001-1280
Ipswitch IMail POP3 Server 7.04 and earlier is affected by CVE-2001-1280. The vulnerability stems from the POP3 service responding differently to valid versus invalid usernames, enabling remote attackers to enumerate users on the system. Affected component: POP3 service of Ipswitch IMail 7.04 and...
CVE-2001-1165
Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool...
Microsoft Windows Local User Information
Using the supplied credentials, Nessus was able to retrieve information for each local user. Note that this plugin itself does not issue a report and only serves to store information about each local user in the KB for further checks. C Tenable Network Security, Inc. include"compat.inc"; if...
CVE-2001-1165
The CVE-2001-1165 entry concerns Intego FileGuard 4.0, which stores user information and passwords with weak encryption. This weak crypto enables local users to escalate privileges by decrypting stored data, for example using the Disengage tool. The vulnerability is localized (local access requir...
Microsoft Windows Domain User Information
Using the supplied credentials, Nessus was able to retrieve information for each domain user. Note that this plugin itself does not issue a report and only serves to store information about each domain user in the KB for further checks. C Tenable Network Security, Inc. include"compat.inc"; if...
Microsoft Windows - Users Information : Disabled Accounts
Using the supplied credentials, Nessus was able to list user accounts that have been disabled. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10897; scriptversion"1.19"; scriptcvsdate"Date: 2018/08/13 14:32:39"; scriptnameenglish:"Microsoft Windows - Users Informatio...
OpenSSH < 3.0.2 Multiple Vulnerabilities
You are running a version of OpenSSH which is older than 3.0.2. Versions prior than 3.0.2 have the following vulnerabilities : - When the UseLogin feature is enabled, a local user could export environment variables, resulting in command execution as root. The UseLogin feature is disabled by...
PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/3609/info PHPNuke is a website creation/maintenance tool. PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by...
Cgisecurity.com Advisory #7: Mailman Email Archive Cross Site Scripting
Hello, This isn't a major threat or anything but this product does allow cross site scripting. From the list of sites below as examples you get an idea of just how popular this product is. http://www1.dshield.org/mailman/listinfo/img20src=javascript:alertdocument.domain...
Bug in PostNuke 0.62, 0.63 and 0.64 (and possibly PHPnuke)
----- IMPACT ----- If an attacker knows the username and userid of a user on a PostNuked system, it is possible to log in as the user without specifying a password. Userid/username is usually available from the Members list. A fix is available at the end of this document. ----- AFFECTED VERSIONS...
phpBB 1.4 - SQL Query Manipulation
source: https://www.securityfocus.com/bid/3142/info phpBB is free, open-source, easy-to-use web forums software. An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service. This problem is due to improper...