webEdition CMS <= 6.0.0.4 LFI Vulnerability - Active Check

webEdition CMS is prone to a local file include LFI vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

phpMyAdmin file_path Parameter Vulnerabilities (PMASA-2009-1)

The version of phpMyAdmin installed on the remote host fails to sanitize user-supplied input to the 'filepath' parameter of the 'bsdispasmimetype.php' script before using it to read a file and reporting it in dynamically-generated HTML. An unauthenticated, remote attacker may be able to leverage...

ExpressionEngine 1.6 - Avtaar Name HTML Injection

source: https://www.securityfocus.com/bid/34193/info ExpressionEngine is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the contex...

MLdonkey HTTP Request Arbitrary File Download Vulnerability

MLdonkey is prone to a vulnerability that lets attackers download arbitrary files. The issue occurs because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information...

Sun Java System Messenger Express 6.3-0.15 - error Cross-Site Scripting

Sun Java System Messenger Express 6.3-0.15 - error Cross-Site Scripting source: https://www.securityfocus.com/bid/34140/info Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may...

Cryptographp 'index.php' Local File Include Vulnerability

Cryptographp is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Sun Java System Messenger Express 6.3-0.15 - 'error' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34140/info Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Butterfly Organizer Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

Butterfly Organizer is prone to multiple cross-site scripting and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application...

Afian 'includer.php' Directory Traversal Vulnerability

Afian is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. OpenVAS Vulnerability Test $Id:...

PHPFootball 'filter.php' Password Hash Information Disclosure Vulnerability

PHPFootball is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain sensitive information that may lead to further attacks. PHPFootball 1.6 is vulnerable; other versions may also be affecte...

Demium CMS Multiple Local File Include and SQL Injection Vulnerabilities

Demium CMS is prone to multiple local file-include vulnerabilities and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute arbitrary local file...

Yektaweb Academic Web Tools CMS 1.4.2.81.5.7 - Multiple Cross-Site Scripting Vulnerabilities

Yektaweb Academic Web Tools CMS 1.4.2.81.5.7 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/33944/info Yektaweb Academic Web Tools CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input...

Afian - 'includer.php' Directory Traversal

source: https://www.securityfocus.com/bid/33943/info Afian is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks...

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting source: https://www.securityfocus.com/bid/34001/info IBM WebSphere Application Server WAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker m...

JOnAS 4.10.3 - select Error Page Cross-Site Scripting

JOnAS 4.10.3 - select Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/33912/info JOnAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

JOnAS 4.10.3 - 'select' Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/33912/info JOnAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

Magento 1.2 - appcodecoreMageAdminModelSession.php?login[Username] Cross-Site Scripting

Magento 1.2 - appcodecoreMageAdminModelSession.php?loginUsername Cross-Site Scripting source: https://www.securityfocus.com/bid/33872/info Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and...

Novell GroupWise < 7.03HP2 / 8.0HP1 WebAccess Multiple XSS

The version of Novell GroupWise WebAccess installed on the remote host fails to sanitize user-supplied input via a POST request to the 'User.id' parameter of the '/gw/webacc' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary...

Clipbucket 1.7 - dwnld.php Directory Traversal

Clipbucket 1.7 - dwnld.php Directory Traversal source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive...

Clipbucket 1.7 - 'dwnld.php' Directory Traversal

source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks...