5371 matches found
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Cross-site scripting vulnerability in 500page.jsp
The test successfully embedded a script in the response, which will be executed once the page is loaded in the user's browser. This means that the application is vulnerable to the Cross-Site Scripting attack. The file 500page.jsp should escape the attributes and parameters to prevent code...
CS-Guestbook 0.1 - Login Credentials Information Disclosure
source: https://www.securityfocus.com/bid/25652/info CS-Guestbook is prone to an information-disclosure vulnerability because the application fails to properly protect sensitive information. An attacker can exploit this issue to access sensitive information that may lead to further attacks...
CellFactor REvolution 1.03 - Multiple Remote Code Execution Vulnerabilities
CellFactor REvolution 1.03 - Multiple Remote Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/25625/info CellFactor: Revolution is prone to multiple remote code-execution vulnerabilities, including a buffer-overflow issue and a format-string issue. Successfully exploiting...
Weblogicnet - files_dir Multiple Remote File Inclusions
Weblogicnet - filesdir Multiple Remote File Inclusions Nyubicrew Community Weblogicnet filesdir Remote File Inclusion vendor : http://www.weblogicnet.com/ source : http://weblogicnet.com/data/weblogicnet.tgz Bug Found By :homeedition2001 a.k.a bius 31-08-2007 contact: [email protected] Website :...
ACG News 1.0 - 'index.php' Multiple SQL Injections
source: https://www.securityfocus.com/bid/25466/info ACG News is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries. Exploiting these issues could allow an attacker to compromise the application, access or...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
ALeadSoft Search Engine Builder - Search.HTML Cross-Site Scripting
source: https://www.securityfocus.com/bid/25391/info ALeadSoft Search Engine Builder is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...
[ELEYTT] 3SIERPIEN2007
Eleytt Research www.eleytt.com Overview: ==================== Michal Bucko, Eleytt Shyaam Sundhar R S, Eleytt Credit: ==================== Michal Bucko, Eleytt, www.eleytt.com/michal.bucko Gynvael Coldwind for providing a good example Vulnerability Table =================== 1. Firefox 2.0.0.6...
Global Centre Aplomb Poll 1.1 - 'vote.php?Madoa' Remote File Inclusion
source: https://www.securityfocus.com/bid/25138/info Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code...
CVE-2007-3383
CVE-2007-3383 is an XSS flaw in Apache Tomcat’s SendMailServlet (examples/jsp/mail/sendmail.jsp) affecting Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.36. The vulnerability allows remote attackers to inject arbitrary script/HTML via the From field (and possibly other fields) during error-message generation....
Unfixed XSS vulnerability at playwithyourmind.com
Security researcher FiSh, has submitted on 25/07/2007 a cross-site-scripting XSS vulnerability affecting playwithyourmind.com, which at the time of submission ranked 480457 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is...
Alisveris Sitesi Scripti - 'index.asp' SQL Injection
source: https://www.securityfocus.com/bid/25005/info Alisveris Sitesi Scripti is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...
CVE-2007-3816
JWIG Context-Dependent Template Calling DoS (CVE-2007-3816) is a denial-of-service/class vulnerability caused by loops of references to external templates. The issue may allow context-dependent attackers to degrade services, but third parties dispute whether privilege boundaries are crossed; some...
MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine
MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine 22:57 15.06.2007 New bonus vulnerability in Google. In this case vulnerability not directly at Google’s site, like at MOSEB-15: Vulnerabilities at images.google.com, but in his search engine called Google Custom Search Engine also known...
Dating Gold 3.0.5 - 'secure.admin.php?int_path' Remote File Inclusion
source: https://www.securityfocus.com/bid/24910/info AzDG Dating Gold is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute an arbitrary remote file containing malicious...
Mail Machine <= 3.989 Local File Inclusion Exploit
No description provided by source. !/usr/bin/perl -w Mail Machine Local File Include Exploit Vuln. v3.980, v3.985, v3.987, v3.988 and v3.989 ! Application homepage : http://www.mikesworld.net/mailmachine.shtml ! Author : H4 / Team XPK ! Contact : [email protected]...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Calendarix 0.7.20070307 - Multiple SQL Injections
Calendarix 0.7.20070307 - Multiple SQL Injections source: https://www.securityfocus.com/bid/24633/info Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...