DUportal Pro 3.4 - 'default.asp' Multiple SQL Injections

source: https://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application,...

APT-webshop 3.0/4.0 - 'modules.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/17425/info APT-webshop is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Einstein 1.01 - Local Password Disclosure

Einstein 1.01 - Local Password Disclosure / Einstein v1.01 Local Password Disclosure Exploit by Kozan Application: Einstein v1.01 and previous versions Procuder: Bfriendly.com Vulnerable Description: Einstein v1.01 discloses passwords to local users. Discovered & Coded by: Kozan Credits to ATmaCA...

iGeneric iG Shop 1.x - Multiple SQL Injections

iGeneric iG Shop 1.x - Multiple SQL Injections source: https://www.securityfocus.com/bid/12627/info iGeneric iG Shop is reportedly affected by multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using them in SQL...

Software602 602 Lan Suite 2004 2004.0.04.1221 - Arbitrary File Upload

Software602 602 Lan Suite 2004 2004.0.04.1221 - Arbitrary File Upload source: https://www.securityfocus.com/bid/12495/info 602 Lan Suite 2004 is reportedly affected by a vulnerability regarding the uploading of file attachments. This issue is due to the application failing to properly sanitize th...

PerlDesk kb.cgi view Parameter SQL Injection

The remote host is running PerlDesk, a web-based helpdesk application written in Perl. The remote version of this software has several SQL injection vulnerabilities, that could allow an attacker to execute arbitrary SQL statements on the remote database. %NASLMINLEVEL 70300 C Tenable Network...

Exponent CMS Multiple Script pathos_core_version Parameter Path Disclosure

The remote host is running Exponent, a web-based content management system implemented in PHP. Directly requesting several different pages reveals the absolute path where Exponent is installed. A remote attacker could use this information to mount further attacks. In addition, the installed versi...

Novell GroupWise WebAccess Error Handler Authentication Bypass

The remote host is running Novell GroupWise WebAccess, a commercial groupware package. The remote version of this software is prone to an authentication bypass attack. An attacker requesting : /servlet/webacc?error=webacc may bypass the authentication mechanism and gain access to the groupware...

Macallan Mail Solution Web Interface Authentication Bypass

The remote host is running Macallan Mail Solution, a mail server POP,SMTP,HTTP for Windows. It is possible to bypass web authentication by using two slashes before the requested resource. According to the vendor, this cannot be used to perform administrative actions. %NASLMINLEVEL 70300 C Tenable...

CVE-2004-1523

Format string vulnerability in the game console in Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service application crash via format string specifiers in a message...

2BGal 2.5.1 - SQL Injection

source: https://www.securityfocus.com/bid/12083/info A remote SQL injection vulnerability reportedly affects 2Bgal. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query. An attacker may leverage this issue to manipulate S...

RTF2LATEX2E 1.0 - Remote Stack Buffer Overflow

source: https://www.securityfocus.com/bid/11994/info It is reported that rtf2latex2e is susceptible to a stack buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied image data prior to copying it into a fixed-size memory buffer. Th...

Ocean12 ASP Calendar Administrative Access

The remote host is running Ocean12 ASP Calendar, a web-based application written in ASP. There is a flaw in the remote software which may allow anyone execute administrative commands on the remote host by requesting the page /admin/main.asp. An attacker may exploit this flaw to deface the remote...

ChBg 1.5 - Scenario File Overflow

source: https://www.securityfocus.com/bid/11957/info ChBg is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this...

Digital Illusions CE Codename Eagle - Remote Denial of Service

Digital Illusions CE Codename Eagle - Remote Denial of Service source: https://www.securityfocus.com/bid/11887/info A remote denial of service vulnerability reportedly affects Digital Illusions CE Codename Eagle. This issue is due to a failure of the application to properly handle exceptional...

Digital Illusions CE Codename Eagle - Remote Denial of Service

source: https://www.securityfocus.com/bid/11887/info A remote denial of service vulnerability reportedly affects Digital Illusions CE Codename Eagle. This issue is due to a failure of the application to properly handle exceptional network data. An attacker may leverage this issue to cause the...

phpScheduleIt < 1.0.1 Reservation.class.php Arbitrary Reservation Modification

According to its banner, the version of phpScheduleIt on the remote host is earlier than 1.0.1. Such versions are reportedly vulnerable to an undisclosed issue that may allow an attacker to modify or delete reservations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[MaxPatrol] SQL-injection in Invision Power Board 2.x

SQL-injection in Invision Power Board 2.x MaxPatrol Security Advisory 11.18.04 November 18, 2004 Release Date: November 18, 2004 Date Reported: November 12, 2004 Severity: High Application: Invision Power Board v2.x Affects versions: IPB 2.0.0, IPB 2.0.1 and IPB 2.0.2. Platform: PHP I. DESCRIPTIO...

Jan Erdmann Jebuch 1.0 - HTML Injection

Jan Erdmann Jebuch 1.0 - HTML Injection source: https://www.securityfocus.com/bid/11463/info It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. This may allow an attacker to inje...

IBM Lotus Domino 6.x - Cross-Site Scripting / HTML Injection

source: https://www.securityfocus.com/bid/11458/info It is reported that Lotus Domino is susceptible to a cross-site scripting and an HTML injection vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input. The cross-site scripting issue could...