4703 matches found
NinkoBB - Cross-Site Request Forgery
Title: NinkoBB CSRF Vulnerability Author: ADEO Security Published: 30/06/2010 Version: 1.3RC5 Possible all versions Vendor: http://ninkobb.com Download: http://ninkobb.com/releases/?NinkoBB-1.3RC5.zip Description: "NinkoBB is an open source forum script written in the PHP language and uses a MySQ...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the 1 commentName, 2 commentEmail, 3 commentWeb, or 4 commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or...
Design/Logic Flaw
Unspecified vulnerability in the tech support diagnostic shell in Cisco Application Extension Platform AXP 1.1 and 1.1.5 allows local users to obtain sensitive configuration information and gain administrator privileges via unspecified API calls...
CVE-2010-1546
Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new article" privileges, to inject arbitrary web script or HTML via the 1 title, 2 subTitle, and 3 author parameters in conjunction with a /admin/news/article/add...
CMS Made Simple < 1.7.1 Cross-Site Scripting Vulnerability
Binary data 5530.prm...
Tele Data's CMS 0.9 SQL Injection
|=================================================================================================| | | | /\ \ /\ \ /\ /\ \ /\ \ /\ \ | | /::\ \ /::\ \ /::| | /\ \ /::\ \ /::\ \ /::\ \ | | /:/:\ \ /:/:\ \ /:|:| | :\ \ /:/:\ \ /:/:\ \ /:/:\ \ | | /:/ :\ \ /:/ :\ \ /:/|:| | /::\ /::\:\ ...
eUploader PRO 3.1.1 XSRF / XSS
----------------------------------------------------------------------------------------------- Title: eUploader PRO 3.1.1 XSRF/XSS Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 16. December 2009...
WP-Forum <= 2.3 SQL Injection
No description provided by source. ============================================= INTERNET SECURITY AUDITORS ALERT 2009-010 - Original release date: September 28th, 2009 - Last revised: December 15th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3703 - Severity: 8.5/10 CVSS Base Scor...
eUploader PRO 3.1.1 (XSRF/XSS) Multiple Vulnerabilities
No description provided by source. ----------------------------------------------------------------------------------------------- Title: eUploader PRO 3.1.1 XSRF/XSS Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 16. December 2009...
RunCMS 2ma post.php SQL injection
Exploit for unknown platform in category web applications ================================= RunCMS 2ma post.php SQL injection ================================= query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query...
FMyClone 2.3 - Multiple SQL Injections
FMyClone V2.3 Multiple SQLi By learn3r hacker from nepal [email protected] Product name: FMyClone Version: 2.3 or maybe lower Home: fmyclone.com Different things might require some privileges to work but still sometimes these might be useful. Vulns in the scripts:...
phpBB3 prime_quick_style SQL Injection
phpBB3 addon primequickstyle GetAdmin Exploit Vulnerability found and exploited by -SmoG- target file: primequickstyle.php vuln: POST parameter "primequickstyle" is injectable. source: http://www.phpbb.com/community/viewtopic.php?f=70&t=692625 HowTo: after login, go to "./ucp.php" and manipulate...
Design/Logic Flaw
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator...
CVE-2008-7115
The CVE-2008-7115 entry documents a remote-authentication bypass against Belkin Wireless G Router/F5D7632-4V6 (firmware 6.01.08). The vulnerability allows an attacker to bypass login and gain administrator privileges by directly requesting one of three CGI binaries: statusprocess.exe, system_all....
Authentication flaw
userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...
CVE-2008-7081
The CVE-2008-7081 entry concerns RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1. The described vulnerability allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. This is a network-accessible issue with complete confidentiality...
CVE-2008-7047
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete rooms and messages via a direct request to admin/home.asp...
CVE-2008-7024
CVE-2008-7024 affects Arz Development The Gemini Portal 4.7 and earlier. The vulnerability allows remote attackers to bypass authentication and obtain administrator privileges by manipulating the user cookie to the value "admin" and setting the name parameter to "users" in admin.php. The root cau...