CVE-2006-0846: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 Referer and 2 User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly usin...

Design/Logic Flaw

The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent HTTPUSERAGENT, which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying tha...

CVE-2006-0805

The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent HTTPUSERAGENT, which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying tha...

Mozilla Firefox 1.5 location.QueryInterface() Code Execution (linux)

Exploit for linux platform in category remote exploits ==================================================================== Mozilla Firefox 1.5 location.QueryInterface Code Execution linux ==================================================================== This file is part of the Metasploit...

ASPThai.Net Guestbook <= 5.5 (Auth Bypass) SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================ ASPThai.Net Guestbook new or die; $cookiejar = HTTP::Cookies-new; $xpl-agent'g00ns'; $xpl-cookiejar$cookiejar; $res = $xpl-post $Server.'checkuser.asp', Content = 'txtUserNam...

xeCMS 1.0.0 RC 2 (cookie) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl xeCMS 1.0.0 RC 2 Remote Command Execution Exploit Copyright c 2006 cijfer cijfer@netti!fi All rights reserved. never ctrl+c again. cijfer$ http://target.com/dir host changed to 'http://target.com/dir' cijfer$ greets to JagX $Id: cijfer-xecmsxpl.pl...

Cross site scripting

Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $SERVERHTTPUSERAGENT variable User-Agent header...

CVE-2005-4727

Cross-site scripting XSS vulnerability in gbook.cgi in gBook before 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header field...

CVE-2005-4559

mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the defaultlayout and layoutsettings variables when an unrecognized HTTPUSERAGENT string is provided, which allows remote attackers to acce...

PHP-Fusion 6.00.3 (rating) Parameter Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================= PHP-Fusion 6.00.3 rating Parameter Remote SQL Injection Exploit ================================================================= !/usr/bin/perl Exploit for PHP-Fusion 6.00....

RANKBOX &lt;= XSS vulnerability

Advisory 1 Title: "RANKBOX = XSS vulnerability" Author: spyburn Contact: [email protected] Website: elitemexico.org Date: 07/11/2005 Risk: High Vendor Url: http://chamberofgold.com Affected Software: RANKBOX Non Affected: We Are: ELITE MEXICO...

HTTP User-Agent overflow

It was possible to kill the web server by sending an invalid GET request with a too long User-Agent field A cracker may exploit this vulnerability to make your web server crash continually or even execute arbirtray code on your system. OpenVAS Vulnerability Test $Id: wwwtoolonguseragent.nasl 8023...

HTTP User-Agent Overflow DoS Vulnerability

It was possible to kill the web server by sending an invalid GET request with a too long User-Agent field. SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

phpBB 2.0.13 (admin_styles.php) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl r57phpbbadmin2exec.pl phpBB adminstyles.php commands execution exploit tested on phpBB 2.0.13 by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru screen r57phpbbadmin2exec.pl -p http://blah.com/phpBB/admin/ -s 0864cb0abb396319c589ebc2a98c2c5d -c...

phpMyFAQ 1.5.1 - 'User-Agent' Remote Shell Injection

?php 17.34 22/09/2005 phpmyfaqxpl.php PhpMyFaq 1.5.1 possibly prior versions shell inject by rgod site: http://rgod.altervista.org make these changes in your php.ini if you have troubles to launch this script: allowcalltimepassreference = on registerglobals = on usage: launch this script from...

CVE-2005-3048: Undefined Security Weakness

Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. dot dot in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated ...

CVE-2005-2853: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the pg parameter to printfaq.php, or the 2 Referer or 3 User-Agent HTTP headers, which are not properly handled by error.php...

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML R...

CVE-2002-1965

Cross-site scripting XSS vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the 1 Javascript events, as demonstrated via an onerror event in an IMG SRC tag or 2 User-Agent field in an HTTP GET request...

CVE-2002-1965: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML via the 1 Javascript events, as demonstrated via an onerror event in an IMG SRC tag or 2 User-Agent field in an HTTP GET request...