Code injection

Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter, which is executed by invocation of index.php. NOTE: some of these details are obtained from...

CVE-2008-6956

Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter, which is executed by invocation of index.php. NOTE: some of these details are obtained from...

CVE-2008-6947

Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php...

Code injection

Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action...

CVE-2009-2736

Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action...

CVE-2009-2736

Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete 1 categories or 2 groups; 3 ban users; or 4 delete users via the admin page...

CVE-2008-6905

Cross-site request forgery CSRF vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete 1 categories or 2 groups; 3 ban users; or 4 delete users via the admin page...

CVE-2009-2653

Summary: CVE-2009-2653 affects Microsoft Windows XP (SP2/SP3) and Windows Server 2003 (pre-SP1) due to a flaw in the NtUserConsoleControl function in win32k.sys. The OpenVAS and related records describe a local privilege-escalation vulnerability in win32k.sys, enabling an administrator to elevate...

WordPress Comment Author URI跨站脚本漏洞

Bugraq ID: 35755 WordPress是一款流行的blog系统。 WordPress存在输入验证问题，远程攻击者可以利用漏洞获得敏感信息。 WordPress不正确过滤评注作者URLs，当管理员查看时可导致重定向到其他站点而泄漏敏感信息。 WordPress Wordpress B2 0.6.2 .1 WordPress Wordpress B2 0.6.2 WordPress WordPress 2.8.1 WordPress WordPress 2.6.5 WordPress WordPress 2.6.2 WordPress WordPress 2.6.1...

Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit

No description provided by source. / alwaysdirtyneverclean.c AKA Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit alwaysdirtyneverclean.zip BY Jeremy Brown 2009 [email protected] 07.21.2009 I've been up for nearly 24 hours only the last few doing research though. This exploit is base...

Inside Microsoft's July Security Patch Batch

Microsoft released six security bulletins today — three rated Critical and three rated Important. Two of the issues are being actively exploited on the Internet and four of the issues are client-side vulnerabilities, which means the exploit can only occur if a user visits an evil website or opens...

Formatstring vulnerability in smbclient

Description The smbclient utility in Samba 3.2.0 - 3.2.12 contains a formatstring vulnerability where commands dealing with file names treat user input as format strings to asprintf. An example is: smb: \ put aa%3Fbb putting file aa%3Fbb as \aa0,000000bb 0,0 kb/s average 0,0 kb/s As is obvious,...

CVE-2009-2115

admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message...

Directory traversal

Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to list directory contents via a .. dot dot in the dir parameter...

Design/Logic Flaw

admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message...

CVE-2009-2116

CVE-2009-2116 affects SkyBlueCanvas 1.1 r237. A directory traversal vulnerability exists in admin.php where the dir parameter can be manipulated with ".." to list directory contents. Impact per NVD indicates partial confidentiality impact; base CVSS~4.0 (MEDIUM), with network attack vector and au...

CVE-2008-6823

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...

CVE-2008-6823

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...