CVE-2007-1174

CVE-2007-1174 describes multiple XSS vulnerabilities in WebAPP prior to 20070214, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors related to user Profiles. The NVD entry lists a base CVSS v2 score of 4.3 (Medium) with impact: integrity partially affected, confide...

Snitz Forums 2000 v3.1 SR4 (pop_profile.asp) SQL Injection Vulnerability

No description provided by source. =================================X=O=R=O=N================================= Snitz Forums 2000 Version 3.1 SR4 popprofile.asp Remote SQL Injection Vulnerability =================================X=O=R=O=N================================= Bulan: xoron xoron.info -...

Code injection

nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles...

CVE-2007-0108

nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles...

CVE-2007-0108

The CVE-2007-0108 issue affects nwgina.dll in Novell Client 4.91 SP3 for Windows (2000/XP/2003). It does not delete user profiles during Terminal Service or Citrix sessions, enabling a remote authenticated user to invoke alternate user profiles. The description does not specify additional technic...

CVE-2006-6007

saveprofile.asp in WebEvents Online Event Registration Template 2.0 and earlier allows remote attackers to change the profiles, passwords, and other information for arbitrary users via a modified UserID parameter...

CVE-2006-6007

The CVE-2006-6007 issue affects WebEvents (Online Event Registration Template) 2.0 and earlier, specifically save_profile.asp. The underlying flaw allows remote attackers to change profiles, passwords, and other information for arbitrary users by altering the UserID parameter. This describes a us...

Debian DSA-958-1 : drupal - several vulnerabilities

Several security related problems have been discovered in drupal, a fully-featured content management/discussion engine. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3973 Several cross-site scripting vulnerabilities allow remote attackers ...

osDate 1.1.7 multiple vulnerabilities

/ osDate 1.1.7 advisory / Date of written Advisory: ------------------------- July, 18 2006 Product: -------- OSdate = 1.1.7 Vendor: ------- http://tufat.com/ Description: ------------ osDate is a full fledged dating script which can be eaily integrated with phpBB and flashChat, and provides...

PassMasterFlex (and PassMasterFlex+) XSS injection

PassMasterFlex and PassMasterFlex+ XSS injection Discovered by: Nomenumbra Date: 5/4/2006 impact:moderate privilege escalation,possible defacement PassMasterFlex+ is a database-driven multiple login that utilizes cookies for authentication. PassMasterFlex+ was written not only to provide an...

[Full-disclosure] BetaBoard Cross Site Scripting vulnerability

//----- Advisory Program : BetaBoard Homepage : http://gonzo.uni-weimar.de/scheffl2/betaboard/ Tested version : 0.1 Found by : Simon MOREL philemon at thehackademy dot net This advisory : Simon MOREL philemon at thehackademy dot net Discovery date : 2006/04/16 //----- Application description...

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

Andrew Widdowson informed us that it's possible to bypass the 'access user profile' permission if the server is running PHP5. No data can be changed though. Versions affected Drupal 4.6.0, 4.6.1, 4.6.2, 4.6.3 Solution If you are running Drupal 4.6.x and PHP5, then upgrade to Drupal 4.6.4...

Hosting Controller 6.1 - User Profile Unauthorized Access

source: https://www.securityfocus.com/bid/13816/info Hosting Controller is prone to an unauthorized access vulnerability. Reportedly an authenticated user can modify other user's profiles. This issue is due to a failure in the application to perform proper authentication before providing access t...

CVE-2005-0899

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...

CVE-2005-0899

CVE-2005-0899 affects AS/400 OS/400 5.2 where LDAP is installed and enabled by default. The vulnerability allows remote authenticated users to obtain OS/400 user profiles by performing a search, indicating a potential information disclosure risk. The available documents do not specify a patch or ...

CVE-2005-0899

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...

Npds BB HTML Injection

I release it very quickly ... So it can be improved : Code to put in a reply or in a topic : Your fake message/td/trtrtd valign="bottom"hr noshade size="1" class="ONGL" &nbspa href="user.php?op=userinfo&uname=User" CLASS="NOIR" target=blankimg src="images/forum/icons/profile.gif" border=0...