CVE-2007-3146

Affected product: Zen Help Desk 2.1. Vulnerability: Insufficient access control allows remote attackers to download the ZenHelpDesk.mdb database via a direct request, because sensitive information is stored under the web root. Impact (as stated): Exposure of a password-containing database. Status...

CVE-2007-3146

Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb...

zen-mdb.txt

--/ INTRODUCTION -- Advisory : Zen Help Desk == Version 2.1 Bypass/Database Download Vulnerability Release Date : 25 / 05 / 2007 Application : Zen Help Desk == Version 2.1 Impact : Remote Googledork : "CopyRight 2004 Zen Help Desk" ,allintitle:Zen Help Desk or or"allinurl:trackrequest.asp" Author...

Zen Help Desk ==> Version 2.1 Bypass/

--/ INTRODUCTION -- Advisory : Zen Help Desk == Version 2.1 Bypass/Database Download Vulnerability Release Date : 25 / 05 / 2007 Application : Zen Help Desk == Version 2.1 Impact : Remote Googledork : "CopyRight 2004 Zen Help Desk" ,allintitle:Zen Help Desk or or"allinurl:trackrequest.asp" Author...

CVE-2007-0885

Cross-site scripting XSS vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen Rainbow.Zen extension allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen Rainbow.Zen extension allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2007-0885

Jira Rainbow.Zen exposes a Cross‑Site Scripting (XSS) vulnerability in Jira/secure/BrowseProject.jspa. The id parameter can be exploited by remote attackers to inject arbitrary script/HTML into a user’s browser. This is documented in CVE‑2007‑0885 and mirrored in the Nuclei template: remediation ...

CVE-2006-6868

Multiple cross-site scripting XSS vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6868

CVE-2006-6868 affects Zen Cart Web Shopping Cart prior to 1.3.7. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. According to the NVD entry, the CVSS v2 base score is 6.8 (Mediu...

CVE-2006-6868

Multiple cross-site scripting XSS vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Zen Cart多个SQL注入漏洞

Zen Cart是一款基于PHP的新闻管理程序。 Zen Cart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zen Cart Web Shopping Cart 1.3 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d...

Re: Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Full Disclosure Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Status: Full Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a...

CVE-2006-5119

Multiple cross-site scripting XSS vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 adminname or 2 adminpass parameter in a admin/login.php, or the 3 adminemail parameter in b admin/passwordforgotten.php...

CVE-2006-5119

Multiple cross-site scripting XSS vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 adminname or 2 adminpass parameter in a admin/login.php, or the 3 adminemail parameter in b admin/passwordforgotten.php...

CVE-2006-5119

Zen Cart 1.3.5 is affected by multiple XSS vulnerabilities: remote attackers can inject arbitrary script or HTML via admin_name or admin_pass in admin/login.php, or admin_email in admin/password_forgotten.php. The CVE-2006-5119 entry records this with a MEDIUM base score (CVSSv2). Connected sourc...

Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL...

CVE-2006-4218

Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter...

CVE-2006-4218

Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter...

CVE-2006-4218

Zen Cart prior to 1.3.0.2 is affected by a directory traversal vulnerability that allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter. Impact is described as partial confidentiality, integrity, and availabilit...

CVE-2006-4214

Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via 1 GPC data to the ipngetstoredsession function in ipnmainhandler.php, which can be leveraged to modify elements of $SESSION; and allow remote authenticated users to...