CVE-2009-0597

SQL injection vulnerability in admin/index.php in w3bcms aka w3blabor CMS before 3.4.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter aka Username field in a login action...

Unfixed XSS vulnerability at vhost.oddcast.com

Security researcher UzmiX, has submitted on 13/12/2008 a cross-site-scripting XSS vulnerability affecting vhost.oddcast.com, which at the time of submission ranked 19418 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/07/2009. It is currentl...

eZ Publish 3.9.0/3.9.5/3.10.1 Command Execution Exploit (admin req)

No description provided by source. / eZ Publish OS Commanding executing exploit by s4avrd0w [email protected] Versions affected 3.x tested on version 3.9.0, 3.9.5, 3.10.1 usage: ./eZPublishabuseoffunctionalityzeroday -u=username -p=password -s=EZPublishserver The options are required: -u Login of t...

eZ Publish 3.9.0/3.9.5/3.10.1 Command Execution Exploit (admin req)

Exploit for unknown platform in category web applications =================================================================== eZ Publish 3.9.0/3.9.5/3.10.1 Command Execution Exploit admin req =================================================================== / eZ Publish OS Commanding executing...

netgear-dos.txt

Not sure how to rate this, but at the same time, i really don't give a shit. one of those days... You can crash the admin interface by sending a malformed URL to the web interface of this wireless router. No recovery, a reboot fixes the issue. Wouldn't even really call it a "malformed URL" either...

Openfire Server 3.6.0a - Authentication Bypass SQL Injection Cross-Site Scripting

Openfire Server 3.6.0a - Authentication Bypass SQL Injection Cross-Site Scripting Advisory: Openfire Server Multiple Vulnerabilities Advisory ID: AKADV2008-001 Release Date: 2008/11/07 Revision: 1.0 Last Modified: 2008/11/07 Date Reported: 2008/05/17 Author: Andreas Kurtz mail at andreas-kurtz.de...

Openfire Server <= 3.6.0a (Auth Bypass/SQL/XSS) Multiple Vulnerability

Exploit for unknown platform in category web applications ======================================================================== Openfire Server = 3.6.0a Auth Bypass/SQL/XSS Multiple Vulnerabilities ======================================================================== Advisory: Openfire Serv...

Openfire AuthCheck Authentication Bypass

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol. The installed version of this software contains a design error in its admin interface in that it allows URLs starting with certain strings, such as 'setup/setup-', to circumvent its auth chec...

Telecom Italia Alice Pirelli routers Backdoor from internal LAN/WAN

No description provided by source. saxdax & drpepperONE Discovered embedded backdoor to activate telnet/ftp/tftp/web extended admin interface with Admin privileges, from internal network lan on Alice ADSL CPE Modem/Router, manufactered by Pirelli based on Broadcom platform. saxdax & drpepperONE...

Telecom Italia Alice Pirelli routers - Backdoor from internal LAN/WAN

saxdax & drpepperONE Discovered embedded backdoor to activate telnet/ftp/tftp/web extended admin interface with Admin privileges, from internal network lan on Alice ADSL CPE Modem/Router, manufactered by Pirelli based on Broadcom platform. saxdax & drpepperONE Router Vendor: Alice Telecom Italia...

mailscan-multi.txt

MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ======================================================================== Affected Products Product/Company Information Vulnerabilities Directory Traversal It is possible to access files on the system outside of the webroot...

Multiple I-O DATA DEVICE wireless LAN routers default configuration does not set authentication

Overview The web administration interface for the WN-APG/R-Series and WN-WAPG/R-Series wireless LAN routers from I-O DATA DEVICE disables authentication in the default configuration. The authentication for the web administration interface for the WN-APG/R-Series and WN-WAPG/R-Series wireless LAN...

CVE-2008-2176

Cross-site scripting XSS vulnerability in admin/category.php in Zomplog 3.8.2 allows remote attackers to inject arbitrary web script or HTML via the catname parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 error and 2 go parameters to the login page...

Sql injection

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager CUCM 5.0/5.1 before 5.13a and 6.0/6.1 before 6.11a allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the 1 admin and 2 user interface pages...

CVE-2008-0026: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager CUCM 5.0/5.1 before 5.13a and 6.0/6.1 before 6.11a allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the 1 admin and 2 user interface pages...

[INFIGO 2008-01-06]: McAfee E-Business Server Remote Preauth Code Execution / DoS

INFIGO IS Security Advisory ADV-2008-01-06 http://www.infigo.hr/en/ Title: McAfee E-Business Server Remote Preauth Code Execution / DoS Advisory ID: INFIGO-2008-01-06 Date: 2008-01-09 Advisory URL: http://www.infigo.hr/en/infocus/advisories/INFIGO-2008-01-06 Impact: Remote code execution Risk...

CVE-2007-5952

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5466

Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to 1 have an unknown impact by sending multiple long strings to the IMAP port 143/tcp; 2 execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; 3 execut...

eXtremail <= 2.1.1 (LOGIN) Remote Stack Overflow Exploit

Exploit for linux platform in category remote exploits ======================================================== eXtremail eXtremail include include include include include define BUFSIZE 8192 define NOP 0x41 define PAD 0 / do you feel lucky? / define DEFPORT 4501 define PORTADMIN DEFPORT define...