CVE-2011-3984

CVE-2011-3984 is an XSS vulnerability in KENT-WEB WEB FORUM (versions 5.1 and earlier) that can be triggered via web form entries to inject arbitrary script/HTML. Public details indicate remote injection possibilities, with related entries noting multiple XSS issues in the same product. Remediati...

CVE-2011-3984

Cross-site scripting XSS vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "web form entries."...

InverseFlow 2.4 - Cross-Site Request Forgery (Add Admin)

Exploit Title: InverseFlow v2.4 CSRF Vulnerabilities Add Admin User + Version : 2.4 + Author : EjRaM HaCkEr + Contact : m2z9.cn + Dork : inurl:"ticket.php?cmd=lost" + Software Link : http://asria.info/download/script/inverseflow.zip...

OsCSS 1.2 - Arbitrary File Upload

OsCSS 1.2 - Arbitrary File Upload Exploit Title: OsCSS Remote File Upload Exploit Date: 12-1-2010 Author: Shichemt Alen Software Link: None Version: 1.2 Platform / Tested on: Windows XP SP2 DE & Ubuntu 10.10 category: webapps/0day Dork : inurl:"sorry script'kiddies" Contact : [email protected]...

cPanel 11.x - Cross-Site Request Forgery (Edit E-mail)

cPanel 11.x - Cross-Site Request Forgery Edit E-mail Exploit Title: Cpanel 11.X Edit E-mail Cross Site Request Forgery exploit Date: 22 - 10 - 2010 Author: Mon7rF Mail : [email protected] Tested on: Windows 7 --------------------------------------------------------------------------------------...

HP Power Manager code execution

Buffer overflow during authentication via web form. Buffer overflow in /goform/formExportDataLogs, directory traversal...

OpenCA HTML injection

OpenCA is vulnerable to a HTML injection attack due to inadequate validation / filtering of user input into a web form frontend. SPDX-FileCopyrightText: 2009 LSS Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Code injection

Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipients via a web form...

CVE-2009-1590

CVE-2009-1590 concerns CGI RESCUE FORM2MAIL prior to 1.42, where a vulnerability in an HTML form-enabled mailer allows a remote attacker to cause arbitrary recipient emails to be sent. Connected sources (JVN/JVNDB, Red Hat, NVD) confirm: FORM2MAIL could send emails independent of configuration, e...

CVE-2009-1590

Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipients via a web form...

Possible User ID and Password Sent Within a Web Form (GET)

Binary data 4673.prm...

Possible User ID and Password Sent Within a Web Form (POST)

Binary data 4672.prm...

CGI RESCUE WebFORM allows unauthorized email transmission

Overview WebFORM from CGI RESCUE is software which delivers the HTML form inputs via email. WebFORM fails to check the mail headers properly, allowing a remote attacker to send email to arbitrary addresses. According to the vendor's information, FORM2MAIL also contains a similar vulnerability, an...

CGI RESCUE WebFORM vulnerable to cross-site scripting

Overview WebFORM, released from CGI RESCUE, is a CGI script written in perl that allows a user to send email messages via a HTML form. WebFORM contains a cross-site scripting vulnerability. Impact An abitrary script may be executed on the user's web browser. Solution None...

DEBIAN-CVE-2007-4174

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...

[Full-disclosure] PacSec Hype Security Team: CGI.pm param injection

====================================================================== PacSec Hype Security Team param injection in CGI.pm and inheritors allows SQL injection and manipulation of data bypassing many perl web form validators ======================================================================...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering 1 invalid characters such as "" or 2 a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldapsearch...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 is affected. The vulnerability arises from improper processing of the $keyword variable in the netaddressbook.php form, causing ldap_search failures to reveal the local path via ldaplib.php error messages. This leads to information disclosure through invalid characte...

CVE-2003-1282

CVE-2003-1282 affects IBM Net.Data. The issue allows remote attackers to disclose sensitive information by causing predefined variables such as $(DTW_CURRENT_FILENAME), $(DATABASE), $(LOGIN), and $(PASSWORD) to be echoed back through a web form. This creates potential exposure of file paths, serv...

CVE-2003-1282

IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords by causing the 1 $DTWCURRENTFILENAME, 2 $DATABASE, 3 $LOGIN, 4 $PASSWORD, and possibly other predefined variables that can be echoed back to the user via a w...