CVE-2008-4305

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-1094

SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall BSF before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a patternx parameter in a searchcountequals action, as demonstrated by the pattern0 parameter...

Sql injection

SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall BSF before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a patternx parameter in a searchcountequals action, as demonstrated by the pattern0 parameter...

Sql injection

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-5434

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-5434

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-3868

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

CVE-2008-3868

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

CVE-2008-3868

Concretely, CVE-2008-3868 affects Interact 2.4.1 and is a CSRF vulnerability that can allow remote attackers to hijack a super administrator’s session to perform actions that create new super administrator accounts. The root cause is forged HTTP requests that are executed in the context of an aut...

Micro CMS 0.3.5 - Remote AddDeletePassword Change

Micro CMS 0.3.5 - Remote AddDeletePassword Change !/usr/bin/perl -------------------------------------------------------------- Micro CMS ; ifdefined $admin print STDOUT deladmin$admin; exit; else print STDOUT "+ Not Defined!\n"; exit; if$tell = /change/i print STDOUT "+ Admin ID : "; chomp$admin...

CVE-2008-4878

Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

Confluence administrators (who are not necessarily sys admins) can configure whitelist

A user who has the "Confluence Administrator" permission, but not necessarily the "System Administrator" permission, can configure the new URL whitelist for the HTML-include and RSS macros. Is this good enough, from a security point of view?...

mybbs142-multi.txt

====================================================================== Advisory: MyBB 1.4.2 - Multiple Vulnerabilities Release Date: October 27 2008 Application: MyBB Version: MyBB 1.4.2 Platform: PHP Vendor URL: http://www.mybboard.net/ Authors: Kellanved, NeoThermic, Techie-Micheal...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the wpcrdooptionspage function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcrhiddenforminput parameter...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

CVE-2008-4542

CVE-2008-4542 describes a cross-site scripting (XSS) vulnerability in Cisco Unity where remote authenticated administrators can inject arbitrary web script or HTML by entering it into the storage/database. Affected products include Cisco Unity 4.x prior to 4.2(1)ES162, Cisco Unity 5.x prior to 5....

CVE-2008-3887

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in a viewus...