SSH Communications Security's Secure Shell Server: SFTP privilege escalation

Background The SSH Secure Shell Server from SSH Communications Security www.ssh.com is a commercial SSH implementation available free for non-commercial use. Description The SSH Secure Shell Server contains a format string vulnerability in the SFTP code that handles file transfers scp2 and sftp2...

hcnews-blindsql.txt

HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.- SQL Inj Code : Admin Username/Password Query...

Magic News Plus 1.0.2 - 'n_layouts.php?link_parameters' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22661/info Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities. An...

Spyce 2.1.3 - 'spyce/examples/request.spy?name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

avast! Antivirus Server Edition Password Setting Weakness

The remote host is running avast! Antivirus Server Edition. The installed version of this software reportedly does not ask for a password even if one is set. A local attacker may be able to leverage this issue to bypass authentication and manipulate settings of the affected application. C Tenable...

Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption

Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption / Title: Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption Description: The intel wireless mini-pci driver provided with Intel / Title: Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption...

SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before

Website Baker Version 2.6.5 and before contains a SQL injection. This can be exploited by using Cookie Poisoning Manufacturer was notified, but want to ignore the request pending release version 3.0 Poison the cookie for the login page with the REMEMBERKEY variable with a standard sql injection '...

212Cafe Guestbook 4.00 - 'show.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22173/info 212Cafe Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecti...

Libgtop2 Library - Local Buffer Overflow

Libgtop2 Library - Local Buffer Overflow source: https://www.securityfocus.com/bid/22054/info The 'libgtop2' library is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying into an insufficiently sized memory buffer. An attack...

EditTag 1.2 - edittag_mp.pl?file Arbitrary File Disclosure

EditTag 1.2 - edittagmp.pl?file Arbitrary File Disclosure source: https://www.securityfocus.com/bid/21890/info EditTag is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow a remote...

eXtreme-fusion 4.02 - 'Fusion_Forum_View.php' Local File Inclusion

source: https://www.securityfocus.com/bid/21621/info eXtreme-fusion is prone to a local file-include vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. By combining thi...

Songbird Media Player <= 0.2 Format String Denial Of Service PoC

No description provided by source. / ======================================================================== 0-day Songbird Media Player = 0.2 Format String Denial Of Service PoC ======================================================================== Songbird Media Player and lower experiance a...

deV!Lz Clanportal [DZCP] <= 1.3.6 Arbitrary File Upload Vulnerability

Exploit for unknown platform in category web applications ===================================================================== deV!Lz Clanportal DZCP = 1.3.6 Arbitrary File Upload Vulnerability ===================================================================== S Y N O P S I S /...

Simple PHP Gallery 1.1 - System SP_Index.php Cross-Site Scripting

Simple PHP Gallery 1.1 - System SPIndex.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21278/info Simple PHP Gallery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to...

BirdBlog 1.4 - admincomments.php?month Cross-Site Scripting

BirdBlog 1.4 - admincomments.php?month Cross-Site Scripting source: https://www.securityfocus.com/bid/21184/info BirdBlog is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have...

Vikingboard 0.1.2 - 'admin.php?act' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/21196/info Vikingboard is prone to multiple HTML-injection vulnerabilities and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues may allow an attacker to access sensitive...

PT-2006-6517 · Speedywiki · Speedywiki

Name of the Vulnerable Software and Affected Versions: Speedywiki version 2.0 Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the showRevisions parameter in the "index.php" file. Recommendations: For...

PT-2006-6311 · Snitz · Snitz Forums 2000

Name of the Vulnerable Software and Affected Versions: Snitz Forums 2000 version 3.4.06 Description: A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved via the RC parameter in the pop mail.asp file. Recommendations: For Snitz Forums 2000...

PunBB 1.x - SQL Injection

source: https://www.securityfocus.com/bid/20786/info PunBB is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may exploit these issues to execute arbitrary script code in the context of the webserver process or to pass...

Simpnews 2.x - 'pwlost.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20714/info SimpNews is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting...