DEBIAN-CVE-2011-2694

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

CVE-2011-2694

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

ZDI-11-156: Sybase M-Business Anywhere agd.exe username Parameter Remote Code Execution Vulnerability

ZDI-11-156: Sybase M-Business Anywhere agd.exe username Parameter Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-156 May 9, 2011 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Sybase -- Affected Products: Sybase MBusiness Anywhere --...

Sybase M-Business Anywhere agd.exe username Parameter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase M-Business Anywhere. Authentication is not required to exploit this vulnerability. The specific flaw exists within agsync.dll, which listens for SOAP and sync HTTP requests on ports 80 and 4...

CVE-2010-0115

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

CVE-2010-4631

Multiple cross-site scripting XSS vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the 1 countrycode parameter to contact.asp, USERNAME parameter to 2 gateway.asp and 3 cart.asp, and the specific parameter to 4 quote.asp and 5 buyitnow...

MODx login.php 'username' Parameter XSS

The installed version of MODx fails to adequately sanitize input passed to the 'username' parameter in the 'login.php' script before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

Sql injection

Multiple SQL injection vulnerabilities in redir.asp in VU Web Visitor Analyst allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameter. NOTE: some of these details are obtained from third party information...

Sql injection

Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the 1 requsername aka Username and 2 reqpassword aka Password parameters. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in x/login in JungleScripts Ajax Short Url Script allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-4720

SQL injection vulnerability in cgi-bin/gnudip.cgi in GnuDIP 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in the CheckLogin function in includes/functions.php in Limny 1.01, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2010-0970

SQL injection vulnerability in phpmylogon.php in PhpMyLogon 2 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

K-Rate - SQL Injection

K-Rate SQL Injection Vulnerability By: e.wiZz! Script site:http://turn-k.net/k-rate In the wild... Vulnerability: SQL Injection in view.php,variable username. Anyway, all sites i saw which are powered by this script are hosted on Apache,and have a modrewrite enabled,so you need to try this:...

MyBB MYPS插件username参数跨站脚本执行漏洞

BUGTRAQ ID: 37464 MyBB是一款流行的Web论坛程序。 如果将action设置为donate的话，MyBB的MYPS插件没有正确地过滤提交给myps.php页面的username参数便返回给了用户，远程攻击者可以通过提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 MyBB 1.4.10 厂商补丁： MyBB ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/...

CVE-2009-3803

Multiple cross-site scripting XSS vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the statusmessage parameter to 1 /news, 2 /comment, 3 /forum, 4 /blog, and 5 /tags; the statusmessage parameter to 6 forum.php, 7 discussion.php, 8...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for 1 requests that change the password via the username parameter to config/changepw.php or 2 stop a...

CVE-2009-3718

CVE-2009-3718 describes a SQL injection in Battle Blog (versions 1.25 and 1.30 build 2). The vulnerability is triggered via the UserName parameter in admin/authenticate.asp, allowing remote attackers to execute arbitrary SQL commands. This aligns with the NVD entry (base score 7.5, HIGH) and indi...

Sql injection

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...

Sql injection

SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...