WordPress Plugin FB Gorilla - game_play.php SQL Injection

WordPress Plugin FB Gorilla - gameplay.php SQL Injection source: https://www.securityfocus.com/bid/69222/info FB Gorilla plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise...

Barracuda Firewall 'cert_error' Parameter Cross-Site Scripting Vulnerability

Barracuda Firewall is a firewall distributed by Barracuda Networks Ltd. A cross-site scripting vulnerability exists in the Barracuda Firewall 'certerror' parameter due to a failure to properly filter user-supplied input. An attacker may be able to exploit this issue to execute arbitrary script co...

Sixnet Sixview Web Console Directory Traversal (CVE-2014-2976)

Sixnet Sixview contains a flaw that allows traversing outside of a restricted path. The issue is due to the program not properly sanitizing user input. With a specially crafted request, a remote attacker can gain access to arbitrary files...

Ilya Birman E2 - @actionscomment-process SQL Injection

Ilya Birman E2 - @actionscomment-process SQL Injection source: https://www.securityfocus.com/bid/68843/info Ilya Birman E2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application,...

Cisco Unified Communications Domain Manager Admin HTTP Redirect Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Cisco Unified CDM Application Software could allow an unauthenticated, remote attacker to redirect a user to a possible malicious website. The vulnerability is due to insufficient validation of user input when...

OL-Commerce - OL-Commercecreate_account.php?country SQL Injection

OL-Commerce - OL-Commercecreateaccount.php?country SQL Injection source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input...

OL-Commerce - '/OL-Commerce/affiliate_show_banner.php?affiliate_banner_id' SQL Injection

source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

Web Servers VWar Remote File Inclusion (CVE-2006-1503)

A Remote File Inclusion vulnerability has been reported in VWar. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system. This protection was previously...

sitestar某功能鸡肋sql(需要一定条件）

简要描述： sql injection 详细说明： sitestar没有做全局的数据转义，很容易出现遗漏的地方。 测试版本sitestarv2.7build140505 出现问题的地方在module/modorder.php 176行开始。 鸡肋的地方在于这是一个普通用户使用的积分兑换功能。需要用户最少有100积分才可以之星下面的逻辑。 public function userjifensave $integral = ParamHolder::get'exchange'; if trimSessionHolder::get'SSLOCALE' != '' // 多语言切换用...

Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability

A vulnerability in the Java database interface of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input...

WordPress BSK PDF Manager Plugin 'wp-admin/admin.php' Multiple SQL Injection Vulnerabilities

WordPress BSK PDF Manager Plugin 'wp-admin/admin.php' Multiple SQL Injection Vulnerabilities. CVE-2014-4944. Webapps exploit for php platform source: http://www.securityfocus.com/bid/68488/info BSK PDF Manager plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fail...

WordPress Plugin BSK PDF Manager - wp-adminadmin.php Multiple SQL Injections

WordPress Plugin BSK PDF Manager - wp-adminadmin.php Multiple SQL Injections source: https://www.securityfocus.com/bid/68488/info BSK PDF Manager plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting these...

Server: Host Header Poisoning

Due to trusting user supplied input and interpret it as Host header an attacker is able to craft a password reset mail with a link pointing to his own site. If a user clicks on the link or a software e.g. antivirus is accessing the link the attacker is able to reset the user password. For more...

Easy File Management Web Server UserID Cookie Handling Buffer Overflow

Added: 07/02/2014 BID: 67542 OSVDB: 107241 Background Easy File Management Web Server is a Microsoft Windows based file management application that allows remote users to upload and download files through a web browser. It also supports online editing of Word, Excel, PowerPoint and PDF documents ...

DUware DUpaypal 3.0/3.1 sub.asp iSub Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/14034/info DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacke...

slimserve httpd 1.0/1.1 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14132/info SlimServe HTTP server is prone to directory traversal attacks due to improper sanitization of user input. This type of attack allows a malicious user to read files that exist outside of the Web server root...

Land Down Under 800/801 list.php Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/14618/info Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation may allow the...

Search Enhanced Module 1.1/2.0 for PHP-Nuke HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15218/info Search Enhanced module for is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated conten...

SugarCRM 1.x/2.0 Module Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/11740/info SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL...

Pluxml-Blog 4.2 'core/admin/auth.php' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37384/info Pluxml-Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...