6663 matches found
CVE-2006-2335
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
Code injection
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
CVE-2006-2335
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
Microsoft Security Bulletin MS06-019 Vulnerability in Microsoft Exchange Could Allow Remote Code Execution (916803)
Microsoft Security Bulletin MS06-019 Vulnerability in Microsoft Exchange Could Allow Remote Code Execution 916803 Published: May 9, 2006 Version: 1.0 Summary Who should read this document: System administrators who use Microsoft Exchange Impact of Vulnerability: Remote Code Execution Maximum...
[Full-disclosure] Cisco Security Advisory: Cisco Unity Express Expired Password Reset Privilege Escalation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unity Express Expired Password Reset Privilege Escalation Advisory ID: cisco-sa-20060501-cue http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml Revision 1.0 For Public Release 2006 May 01 2300 UTC GMT...
CVE-2006-2129
Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in setinc.php...
CVE-2006-2129
CVE-2006-2129 describes a direct static code injection in Pro Publish 2.0. The flaw allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings stored in set_inc.php. Documents consistently identify the affected product as Pro Publish 2.0 and note that acc...
CVE-2006-2129
Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in setinc.php...
CVE-2006-2103
SQL injection vulnerability in MyBB MyBulletinBoard 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the 1 query string $querystring variable in a admin/adminlogs.php, which is not properly handled by adminfunctions.php; or 2 setid, 3 expand, 4 title, or 5 si...
CVE-2006-2103
SQL injection vulnerability in MyBB MyBulletinBoard 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the 1 query string $querystring variable in a admin/adminlogs.php, which is not properly handled by adminfunctions.php; or 2 setid, 3 expand, 4 title, or 5 si...
Directory traversal
Directory traversal vulnerability in actionadmin/paysubscriptions.php in Invision Power Board IPB 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. dot dot in the name parameter, preceded by enough backspace %08...
CVE-2006-2060
Directory traversal vulnerability in actionadmin/paysubscriptions.php in Invision Power Board IPB 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. dot dot in the name parameter, preceded by enough backspace %08...
CVE-2006-2060
Directory traversal vulnerability in actionadmin/paysubscriptions.php in Invision Power Board IPB 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. dot dot in the name parameter, preceded by enough backspace %08...
Sql injection
Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the 1 id parameter in a user.php, or 2 where and 3 order parameters to b admin.php...
Multiple critical and high risk issues in Oracle's database server
David Litchfield of NGSSoftware has discovered multiple critical and high risk vulnerabilities in Oracle's Database Server. Versions affected include Oracle Database 10g Release 2, versions 10.2.0.1, 10.2.0.2 Oracle Database 10g Release 1, versions 10.1.0.4, 10.1.0.5 Oracle9i Database Release 2,...
CVE-2006-1658
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...
Code injection
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...
CVE-2006-1658
Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts...