Sql injection

SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter...

CVE-2007-6291

CVE-2007-6291 affects Xigla Absolute Banner Manager .NET 4.0. The vulnerability is a SQL injection in abm.aspx accessible via the z parameter, enabling remote attackers to execute arbitrary SQL commands. The entry is rated CVSS v2 base score 7.5 (HIGH) with network access and low complexity. Expl...

CVE-2007-6291

SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter...

xigla-sql.txt

HackerSafe Labs - Security Advisory http://www.hackersafelabs.com/ Date: 12/06/2007 Vendor: http://www.xigla.com Package: Xigla Absolute Banner Manager Versions: v4.0 Credit: Joseph Pierini - HackerSafe Labs Risk: Related Exploit Range: Remote Attack Complexity: Medium Level of Authentication...

Information disclosure

Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

CVE-2007-6269

Multiple SQL injection vulnerabilities in xlaabsolutenm.aspx in Absolute News Manager.NET 5.1 allow remote attackers to execute arbitrary SQL commands via the 1 z, 2 pz, 3 ord, and 4 sort parameters...

CVE-2007-6271

Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message...

Directory traversal

Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-6270

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

CVE-2007-6268

Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-6270

Absolute News Manager.NET 5.1 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the rmore parameter in xlaabsolutenm.aspx and the template parameter in pages/default.aspx. The issue arises from unsafely handling u...

CVE-2007-6268

Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

EUVD-2007-6238

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

CVE-2007-6269

Multiple SQL injection vulnerabilities in xlaabsolutenm.aspx in Absolute News Manager.NET 5.1 allow remote attackers to execute arbitrary SQL commands via the 1 z, 2 pz, 3 ord, and 4 sort parameters...

CVE-2007-6271

Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message...

CVE-2007-6270

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

CVE-2007-6269

CVE-2007-6269 affects Absolute News Manager.NET 5.1. Multiple SQL injection vulnerabilities exist in xlaabsolutenm.aspx exploitable via the (1) z, (2) pz, (3) ord, and (4) sort parameters. Remote attackers can execute arbitrary SQL commands. CVSS v2 base score 7.5 (HIGH) with network attack vecto...

CVE-2007-6271

CVE-2007-6271 affects Absolute News Manager.NET 5.1. The vulnerability is an information disclosure: remote attackers can obtain the installation path by requesting getpath.aspx, which leads to an error message revealing path details. The connected sources confirm this specific behavior across mu...

CVE-2007-6268

In CVE-2007-6268, Absolute News Manager.NET 5.1 is vulnerable via directory traversal in pages/default.aspx, allowing an attacker to read arbitrary files by manipulating the template parameter (..). The underlying issue is a path traversal in the template parameter; no exploitation details are pr...