Clever Copy 2.0 - categorysearch.php Cross-Site Scripting

Clever Copy 2.0 - categorysearch.php Cross-Site Scripting source: https://www.securityfocus.com/bid/14395/info Clever Copy is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

PHP Advanced Transfer Manager 1.21 - Arbitrary File Inclusion

PHP Advanced Transfer Manager 1.21 - Arbitrary File Inclusion source: https://www.securityfocus.com/bid/13691/info PHP Advanced Transfer Manager is prone to an arbitrary file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An...

phpMyDirectory review.php subcat Parameter XSS

The version of phpMyDirectory installed on the remote host suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input to its 'review.php' script through various parameters. A remote attacker can exploit these flaws to steal cookie-based authentication...

possible SQL injection in Subdreamer

//==========================================// GHC - Subdreamer - ADVISORY // Product: Subdreamer Version: Subdreamer Light // URL: www.subdreamer.com VULNERABILITY CLASS: SQL injection //==========================================// Product Description "Powered by PHP and MySQL, Subdreamer provid...

PBLang Bulletin Board System 4.x - SendPM.php Directory Traversal

PBLang Bulletin Board System 4.x - SendPM.php Directory Traversal source: https://www.securityfocus.com/bid/12690/info PBLang is reported prone to a directory traversal vulnerability. It is reported that the issue exists due to a lack of sufficient sanitization performed on user-supplied input. A...

escripts software e_board 4.0 - Directory Traversal

source: https://www.securityfocus.com/bid/12048/info It is reported that eBoard is vulnerable to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. By including '../' directory traversal sequences and a NULL %00 in the...

ABC2MIDI 2004-12-04 - Multiple Stack Buffer Overflow Vulnerabilities

source: https://www.securityfocus.com/bid/12019/info It is reported that abc2midi is susceptible to two stack buffer overflow vulnerabilities. These issues are due to a failure of the application to properly bounds check user-supplied image data prior to copying it into fixed-size memory buffers...

[Full-Disclosure] Click and Build eCommerce Platform Cross Site Scripting

ClickandBuild: http://apply.clickandbuild.com/ Online eCommerce platform. Vulnerability The vulnerability lies in the "listPos" variable in the script running at cashncarrion.co.uk. It does not properly secure user inputted variables, presumably as the user is not supposed to input the variable b...

eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection

source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI. As a result of this a malicious user may influence database...

Athena Web Registration - Remote Command Execution

source: https://www.securityfocus.com/bid/9349/info A problem has been reported in the handling of user-supplied input by the Athena Web Registration scripts. Because of this, it may be possible for an attacker to gain unauthorized access to a vulnerable system...

MathoPD 1.x - Remote Buffer Overflow

MathoPD 1.x - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/9871/info It has been reported that Mathopd is prone to a remote buffer overflow vulnerability. The issue arises due to a failure to check the bounds of a buffer storing user-supplied input. It may be possible for...

Divine Content Server 5.0 - Error Page Cross-Site Scripting

Divine Content Server 5.0 - Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/8763/info It has been reported that Divine Content Server is prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the...

DSA-351 php4 - cross-site scripting

Bulletin has no description...

ttcms and ttforum exploits

hope this is the right place to send this exploit info, I found three diffrent exploits for a forum software / cms software: ------------------------------------------------------------------------------------------------------------------------------------------------ Affected Product: ttCMS or...

CGI-City's CCLOG Script Injection Vulns

CGI-City's CCGuestBook Script Injection Vulnerabilities Discovered By BrainRawt [email protected] About CCGuestBook: ------------------ CC Guestbook is a simple guestbook program that is very easy to configure and install. It features a notification facility which sends an email alert to the...

phpBB 2.0.3 - Script Injection

phpBB 2.0.3 - Script Injection source: https://www.securityfocus.com/bid/6248/info phpBB does not properly sanitize user input in forum postings. This could allow a malicious user to inject script code into a forum post which would in turn be executed when the page is viewed by other users. Scrip...

Mountain Network Systems webcart.cgi Arbitrary Command Execution

webcart.cgi is installed and does not properly filter user input. An attacker may use this flaw to execute any command on your system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. untested Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists...

CVE-2002-0555

IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it...

Jon Howell Faq-O-Matic 2.7 - Cross-Site Scripting

Jon Howell Faq-O-Matic 2.7 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4565/info Faq-O-Matic 2.711 and 2.712 is a web-based Frequently Asked Question FAQ management system. It is vulnerable to a cross site scripting issue arising from a failure to filter HTML or script from a...

Aktivate Shopping System Cross Site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aktivate Shopping System Cross Site Scripting Vulnerability Type: Cross Site Scripting Release Date: December 18, 2001 Product / Vendor: Aktivate is a complete, end-to-end e-commerce solution aimed at Linux and other Unices. Aktivate is targeted at...