1048 matches found
dovecot -- Specific LDAP + auth cache configuration may mix up user logins
Dovecot reports: If two users with the same password and same passfilter variables log in within authcachettl seconds 1h by default, the second user may get logged in with the first user's cached passattrs. For example if passattrs contained the user's home/mail directory, this would mean that th...
the pw of a back door way-vulnerability warning-the black bar safety net
data\bbscache\adminrecord. php is recording the background to the landing and operation,we see how the operation of this file: admin\admincp.php: $bbsrecordfile=DP."data/bbscache/adminrecord.php"; if! fileexists$bbsrecordfile writeover$bbsrecordfile,"? php die;?& gt;\n"; //这个 if 只是 说 如果 不 存在...
Flatnuke3 Remote Cookie Manipoulation / Privilege Escalation
--------------------------------------------------------------- / | | / | / |/ | | |/ | | / | | | | | |/ | | // | || | ||| /| / / | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...
Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation
--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- Flatnuke3...
CVE-2003-1352
Gabber 0.8.7 sends an email to a specific address during user login and logout, which allows remote attackers to obtain user session activity and Gabber version number by sniffing...
CVE-2003-1352
CVE-2003-1352 relates to Gabber 0.8.7, where an info-leak occurs because the client sends an email to a specific address during user login and logout. This behavior can let an attacker sniff (eavesdrop) user session activity and reveal the Gabber version number. The published data indicates a med...
DEBIAN-CVE-2007-5106
Cross-site scripting XSS vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the userlogin parameter...
DTSA-60-1 kdebase - kdm allows user logins without a password in some configurations
Bulletin has no description...
Unfixed XSS vulnerability at www.freedback.com
Security researcher Dr.Optix, has submitted on 09/09/2007 a cross-site-scripting XSS vulnerability affecting www.freedback.com, which at the time of submission ranked 46026 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/09/2007. It is...
Php Blue Dragon CMS 3.0.0 Remote Code Execution Exploit
No description provided by source. ?php // Exploit Name: Php Blue Dragon CMS 3.0.0 Code Execution Exploit //Script Homepage: http://phpbluedragon.pl/ // Autor: Kacper [email protected] // Autor Homepage: devilteam.eu | kacper.bblog.pl //Pozdrawiam wszystkich ludzi z DEVIL TEAM, Zapraszam na irc...
LANAI CMS SQL注入漏洞
BUGTRAQ ID: 25193 CNCAN ID:CNCAN-2007080604 LANAI CMS是一款基于PHP的WEB应用程序。 LANAI CMS不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 RedLine Software LANAI CMS 1.2.14 http://la-nai.sourceforge.net/...
Prozilla Pub Site Directory (directory.php cat) SQL Injection Vulnerbility
Exploit for unknown platform in category web applications ========================================================================== Prozilla Pub Site Directory directory.php cat SQL Injection Vulnerbility ==========================================================================...
Prozilla Pub Site Directory - 'Directory.php?cat' SQL Injection
--==+================================================================================+==-- --==+ Prozilla Pub Site Directory SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: prozilla.com DORK...
AlstraSoft Template Seller Pro <= 3.25 Admin Password Change Exploit
Exploit for unknown platform in category web applications ==================================================================== AlstraSoft Template Seller Pro = 3.25 Admin Password Change Exploit ==================================================================== !/usr/bin/php -q -d shortopentag=...
Quicksilver Social Bookmark information leak
User login and pasword are logged to Console.log file...
Remedy Action Request System 5.01.02 - User Enumeration
======================================================= Remedy Action Request System User Enumeration ======================================================= Davide Del Vecchio Adv11 Discovered in: 08/01/2007 Version affected: Remedy Action Request System 5.01.02 Patch 1267. The same vulnerable...
phpBB (privmsg.php) XSS Exploit
phpBB privmsg.php XSS Exploit By: Demential Web: http://headburn.altervista.org E-mail: [email protected] PhpBB website: http://phpbb.com Exploit tested on phpBB 2.0.21 Secunia.com said: Input passed to the form field "Message body" in privmsg.php is not properly sanitised before it is returned to...
Magic Photo Storage Website - userlogin.php?_config[site_path] Remote File Inclusion
Magic Photo Storage Website - userlogin.php?configsitepath Remote File Inclusion source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these...
igshop10-multiple.txt
"If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;"; http://127.0.0.1/igshop/page.php?action=;phpinfo;//...
ig shop 1.0 - Code Execution / SQL Injection
"If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;"; http://127.0.0.1/igshop/page.php?action=;phpinfo;//...