PHPwebnews 0.1 - 'bukutamu.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23448/info The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecti...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

FiSH-irssi - Multiple Remote Buffer Overflow Vulnerabilities

FiSH-irssi - Multiple Remote Buffer Overflow Vulnerabilities source: https://www.securityfocus.com/bid/22880/info FiSH is prone to multiple remote buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer...

Active Calendar 1.2 - '/data/js.php?css' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22705/info Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Shop Kit Plus - 'StyleCSS.php' Local File Inclusion

source: https://www.securityfocus.com/bid/22697/info Shop Kit Plus is prone to a local file-include vulnerability because it fails to adequately sanitize user-supplied data. An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of...

CVE-2007-0928

The CVE-2007-0928 issue concerns Virtual Calendar where sensitive data is stored under the web root with insufficient access control. This allows remote attackers to download an encoded password via a direct request for pwd.txt, indicating improper access restrictions on sensitive files. Reported...

ovidentia5x-rfi.txt

Author : H0tTurk- Author2: Hotturk web app : OVidentia 5.x Series Remote File İnclude My Site : WwW.H0tTurk.CoM Referance:http://www.securityfocus.com/archive/1/456893 Thanx : DrmaxVirus,GencTurk,Madconfig,EnjexioN,TiT,Kurtefendy,LuciferCihan,Arabian-FighterZ,Sawturk,Ayyıldız,OzelHarekatTim...

Tagit! Tagit2b 2.1.B Build 2 - 'tagviewer.php' Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/22518/info TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other...

Tagit! Tagit2b 2.1.B Build 2 - 'tag_process.php' Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/22518/info TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other...

CVE-2006-6977

CVE-2006-6977 affects FreeTextBox’s Basic Toolbar Selection. The vulnerability is a cross-site scripting flaw in the A tag where a javascript: URI in href or onmouseover can be used to run arbitrary JavaScript in a remote context. Affected component is the toolbar’s HTML output; the underlying is...

CVE-2006-6954

The CVE-2006-6954 entry affects Flock beta 1 0.7, where a remote attacker can cause a denial of service (application crash) by delivering a web page that contains a large number of nested marquee tags. This vulnerability is related to CVE-2006-2723. The provided documents do not specify a remedia...

Oracle Buffer Overflow in DBMS_LOGREP_UTIL.GET_OBJECT_NAME

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oracle Database Buffer overflow vulnerability in procedure DBMSLOGREPUTIL.GETOBJECTNAME DB08 AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle Jan 18, 2007 Affected versions: Oracle Database Server versions 9iR1...

Oracle Multiple Buffer Overflows and DoS attacks in public procedures of MDSYS.MD

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oracle Database Buffer overflows and Denial of service vulnerabilities in public procedures of MDSYS.MD DB05 AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle Jan 18, 2007 Affected versions: Oracle Database Serv...

Oracle Buffer Overflow in DBMS_DRS.GET_PROPERTY

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oracle Database Buffer overflow vulnerabilities in procedure DBMSDRS.GETPROPERTY DB03 AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle Jan 18, 2007 Affected versions: Oracle Database Server versions 9iR2 and...

Authentication flaw

The WSEE runtime WS-Security runtime in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security...

CVE-2007-0416

The WSEE runtime WS-Security runtime in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security...

CVE-2007-0416

CVE-2007-0416 affects BEA WebLogic Server 9.0/9.1: the WSEE runtime (WS-Security runtime) does not verify credentials during decryption of client messages, enabling remote attackers to bypass application security. Exploitation details are not provided in the sources; CVSS base score is 7.5 (HIGH)...

CVE-2007-0156

The CVE-2007-0156 entry concerns M-Core where the application stores its database under the web document root, enabling information disclosure if an attacker directly requests db/uyelik.mdb. Affected component: the database file accessed via the web root; root cause: improper placement of the dat...

Magic Photo Storage Website - '/admin/add_templates.php?_config[site_path]' Remote File Inclusion

source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying...

Magic Photo Storage Website - '/admin/admin_password.php?_config[site_path]' Remote File Inclusion

source: https://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying...