Sahana 0.6.2 - 'mod' Local File Disclosure

source: https://www.securityfocus.com/bid/36826/info Sahana is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information from local files on computers running t...

Mega File Hosting Script 1.2 - emaillinks.php Cross-Site Scripting

Mega File Hosting Script 1.2 - emaillinks.php Cross-Site Scripting source: https://www.securityfocus.com/bid/36413/info Mega File Hosting Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execu...

eCardMAX - Multiple Cross-Site Scripting Vulnerabilities

eCardMAX - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/43570/info eCardMAX is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

Joomla! Component Permis 1.0 (com_groups) - 'id' SQL Injection

source: https://www.securityfocus.com/bid/35849/info The Permis 'comgroups' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise th...

Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities

Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/44454/info FlatNux is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute...

SA-CONTRIB-2009-029 - Views Bulk Operations - Access Bypass

Views Bulk operations allows registered procedures called actions to be applied on a result set of Drupal nodes, returned by the Views module. Through the Views Bulk Operations interface, it is possible to let users who are not authorized to update specific nodes or classes of nodes, to still app...

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34531/info Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities. A remote attacker can exploit the user-enumeration...

Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection

source: https://www.securityfocus.com/bid/33859/info The gigCalendar component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...

Clipbucket 1.7 - 'dwnld.php' Directory Traversal

source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks...

OpenX 2.6.2 - 'MAX_type' Local File Inclusion

source: https://www.securityfocus.com/bid/33458/info OpenX is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may...

[SECURITY] CVE-2008-2938 - Apache Tomcat information disclosure vulnerability - Update 2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-2938: Apache Tomcat information disclosure vulnerability - Update 2 Severity: Important Vendor: Multiple was The Apache Software Foundation Versions Affected: Various Description new information: This vulnerability was originally reported to...

SA-2008-072 - Storm Project - SQL injection

Storm SpeedTech Organization and Resource Manager is a project management application for Drupal. Unfortunately the Storm module allows users with access to the storm projects to enter input values which are then used directly in SQL queries without being sanitized, enabling SQL injection attacks...

Oracle Database 11g — EXFSYS PL/SQL injection vulnerability

Application: Oracle database 11G Versions Affected: Oracle 11.1.0.6 and 10.2.0.1 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 17.11.2008 Vendor response: 18.11.2008 Last response: 24.11.2008 Date of Public Advisory: 13.01.2009 Author: Alexandr Polyakov Description...

TurnkeyForms Software Directory 1.0 - SQL Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/32175/info TurnkeyForms Software Directory is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

MapCal 0.1 - id SQL Injection

MapCal 0.1 - id SQL Injection source: https://www.securityfocus.com/bid/31304/info MapCal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

BLUEPAGE CMS 2.5 - PHPSESSID Session Fixation

BLUEPAGE CMS 2.5 - PHPSESSID Session Fixation source: https://www.securityfocus.com/bid/31315/info BLUEPAGE CMS is prone to a session-fixation vulnerability. Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application. BLUEPAGE CMS 2.5 is...

Gallery 2.0 - Multiple Cross-Site Scripting Vulnerabilities

Gallery 2.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/31060/info Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitra...

Bugzilla 3.1.4 - --attach_path Directory Traversal

Bugzilla 3.1.4 - --attachpath Directory Traversal source: https://www.securityfocus.com/bid/30661/info Bugzilla is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrar...

Chupix CMS Contact Module 0.1 - index.php Multiple Local File Inclusions

Chupix CMS Contact Module 0.1 - index.php Multiple Local File Inclusions source: https://www.securityfocus.com/bid/30564/info The Contact module for Chupix CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploi...

DodosMail 2.5 - dodosmail.php Local File Inclusion

DodosMail 2.5 - dodosmail.php Local File Inclusion source: https://www.securityfocus.com/bid/30112/info DodosMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings ...