4686 matches found
PHPX 3.x - '/news.php' Cross-Site Request Forgery / Arbitrary Command Execution
source: https://www.securityfocus.com/bid/10284/info It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands. This issue could permit a remot...
PHPX 3.x - images.php Cross-Site Request Forgery Arbitrary Command Execution
PHPX 3.x - images.php Cross-Site Request Forgery Arbitrary Command Execution source: https://www.securityfocus.com/bid/10284/info It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properl...
PHPX 3.x - page.php Cross-Site Request Forgery Arbitrary Command Execution
PHPX 3.x - page.php Cross-Site Request Forgery Arbitrary Command Execution source: https://www.securityfocus.com/bid/10284/info It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly...
PHPX 3.x - user.php Cross-Site Request Forgery Arbitrary Command Execution
PHPX 3.x - user.php Cross-Site Request Forgery Arbitrary Command Execution source: https://www.securityfocus.com/bid/10284/info It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly...
Citrix Metaframe client disk access
Server administrator can access client drives...
CVE-2003-1245
index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where sessionid is set to the MD5 hash of a session cookie...
CVE-2003-1488
The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...
Mambo Open Source 4.0.14 SQL injection
Product ------- Mambo Open Source 4.0.14 Vendor ------ http://www.mamboserver.com Details ------- Mambo Open Source is the open source Web Content Management System. Mambo Open Source CMS is used by many websites including the commercial ones. The function show in mambo/articles.php file is like...
Philboard Forum Vulnerability
Philboard Vulnerability Severity : High Possible gain administrator/users access on Forum Board Systems Affected: Philboard up to v1.14 Vendor URL: http://www.youngpip.com/philboard.asp Vuln Type : Cookie Injection Status : Vendor contacted, fixed version is not available cause they didn't respon...
P-News p-news.php Name Field Privilege Escalation
The remote host is running the p-news bulletin board. There is a flaw in the version in use which may allow an attacker who has a 'Member' account to upgrade its privileges to administrator by supplying a malformed username. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From: "Peter...
TextPortal Default Password Vulnerability
TextPortal Default Password Vulnerability Advisory ID: B$H-2003:001 Advisory URL: http://www.tar.hu/bsh/reports/bsh-2003-001.txt Date: 2003.05.22. Original Advisory Date: 2003.05.10. Discovery date: 2003.05.10. Type: Vulnerability / Exploit Product: TextPortal Affected versions: All as of discove...
ptnews.txt
PTNews v1.7.7 - Access to administrator functions without authentification .oO Overview Oo. PTNews v1.7.7 - Access to administrator functions without authentification Discovered on 2003, April, 7th Vendor: PTNews - http://www.openbg.net/ptsite/ PT News is a simple news system. This is lite soluti...
CVE-2002-1884
index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin"...
MyPHPSoft MyPHPLinks 2.1.92.2 - SQL Injection Administration Bypassing
MyPHPSoft MyPHPLinks 2.1.92.2 - SQL Injection Administration Bypassing source: https://www.securityfocus.com/bid/6395/info MyPHPLinks is a freely available, open source PHP application distributed by MyPHPSoft. It is available for Unix, Linux, and Microsoft Windows operating systems. It has been...
Netscape and iPlanet Enterprise Servers fail to sanitize log files before they are displayed using the administration client
Overview IPlanet Enterprise Server and Netscape Enterprise Server versions prior to 4.1. SP12 have a vulnerability involving the rendering of tags embedded in the web logs when viewed through the administration client. Description Requests made to web servers are routinely logged by the web serve...
Windows FTP Server NULL Administrator Password
The remote server is incorrectly configured with a NULL password for the user 'Administrator' and has FTP enabled. This script was written by Keith Young See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title 2/04/2009 include"compat.inc"; ifdescription scriptid1116...
Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Modification
source: https://www.securityfocus.com/bid/5502/info Reportedly, it is possible for an administrator to manipulate create, modify etc. files outside of the FUDForum directories. This vulnerability is present in the 'adm/admbrowse.php' script. The vulnerability is the result of FUDForum allowing...
Ilia Alshanetsky FUDForum 1.2.81.9.82.0.2 - File Modification
Ilia Alshanetsky FUDForum 1.2.81.9.82.0.2 - File Modification source: https://www.securityfocus.com/bid/5502/info Reportedly, it is possible for an administrator to manipulate create, modify etc. files outside of the FUDForum directories. This vulnerability is present in the 'adm/admbrowse.php'...
EUVD-2002-0778
iCon administrative web server for Critical Path inJoin Directory Server 4.0 allows authenticated inJoin administrators to read arbitrary files by specifying the target file in the LOG parameter...
