1540 matches found
CVE-2006-4733
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system SIPS 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the configsipssys parameter. NOTE: the product's documentation recommends placing the...
CVE-2006-4733
CVE-2006-4733 : A PHP remote file inclusion vulnerability in sipssys/code/box.inc.php affects Haakon Nilsen’s SIPS up to version 0.3.1. The issue allows an attacker to execute arbitrary PHP code by supplying a URL in the config[sipssys] parameter. The vendor note states placing the affected file ...
CVE-2006-3830
The Languages selection in the admin interface in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to upload files with arbitrary extensions to the bmc/Inc/Lang directory. NOTE: because the uploaded files cannot be accessed through HTTP, this...
Code injection
Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in setinc.php...
HobSR SQL inj. vuln
HobSR SQL inj. vuln Vuln. dicovered by : r0t Date: 5 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/hobsr-sql-inj-vuln.html vendor:www.hobosworld.com/scripts.php?id=5 affected version:1.0 and prior Product Description: HobSR is an top sites script where users sign up to have their...
JPortal Web Portal 2.2.12.3.1 - comment.php SQL Injection
JPortal Web Portal 2.2.12.3.1 - comment.php SQL Injection source: https://www.securityfocus.com/bid/15324/info JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query. Successful exploitati...
Project admin is presented with an option to select a Screen Scheme
The option of changing the scheme should only be given to the global admins...
Project admin is presented with an option to select a Screen Scheme
The option of changing the scheme should only be given to the global admins...
Project admin is presented with an option to select a Screen Scheme
The option of changing the scheme should only be given to the global admins...
Sql injection in jPortal version 2.3.1 (module download)
Versions: all from 2.2.1 to 2.3.1+Service Pack+shop jportalI check this bug only on one site SQL injection attack if magicquotesqpc=Off Problem is in file serching engine download.php, witch code is in “module/down.inc.php” file: code if$cat=='all' $q = "AND title LIKE '$word'"; else $q = "AND...
jPortalSQL.txt
Versions: all from 2.2.1 to 2.3.1+Service Pack+shop jportalI check this bug only on one site SQL injection attack if magicquotesqpc=Off Problem is in file serching engine download.php, witch code is in module/down.inc.php file: if$cat=='all' $q = "AND title LIKE '%$word%'"; else $q = "AND...
mybbXSS.txt
XSS VULN IN ALL MYBB VERSIONS INCLUDING PR2 Vendor: given SEVEN days notice, no patch released! Just to say, I am apalled with the fact that I contacted MyBB on the 30 August, and was originally not planning to go public. However, because they have failed to release a patch I have decided to aler...
[Full-disclosure] XSS VULN IN ALL MYBB VERSIONS (INCLUDING PR2)
XSS VULN IN ALL MYBB VERSIONS INCLUDING PR2 Vendor: given SEVEN days notice, no patch released! Just to say, I am apalled with the fact that I contacted MyBB on the 30 August, and was originally not planning to go public. However, because they have failed to release a patch I have decided to aler...
jPORTAL 2.2.12.3.1 - download.php SQL Injection
jPORTAL 2.2.12.3.1 - download.php SQL Injection source: https://www.securityfocus.com/bid/14926/info JPortal is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...
CVE-2005-1816
Invision Power Board IPB 1.0 through 2.0.4 allows non-root admins to add themselves or other users to the root admin group via the "Move users in this group to" screen...
[Hat-Squad] GFI L.N.S.S 5.0 Insecure Credential Storage
February 28, 2005 Hat-Squad Advisory: GFI L.N.S.S 5.0- Insecure Credential Storage Product: GFI Languard Network Security Scanner Vendor Url: http://gfi.com/ Version: 5.0 Vulnerability: Insecure Credential Storage Release Date: February 28, 2005 Vendor Status: Informed on 22 February 2005 Respons...
NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities.
--== NERF gr0up security advisory 2 ==-- Multiple vulnerabilities in web-shop 1C: Arcadia, in module tradecli.dll 1. Show path scripts directory. Exploit: http://host/scripts/tradecli.dll?template=nonexistfile Will show error message, witch consist full path to work dir usually /scripts. Advice f...
PT-1999-1448 · Ypserv · Ypserv
Name of the Vulnerable Software and Affected Versions: ypserv affected versions not specified Description: The issue allows local administrators to modify password tables, which could lead to unauthorized access or changes to sensitive information. Recommendations: At the moment, there is no...
PT-1999-1221 · Microsoft · Windows Nt
Name of the Vulnerable Software and Affected Versions: Windows NT affected versions not specified Description: The issue concerns inappropriate user membership in various groups, including Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators,...
