3697 matches found
phNNTP 1.3 - article-raw.php Remote File Inclusion
phNNTP 1.3 - article-raw.php Remote File Inclusion phNNTP v1.3 Remote File Inclusion CreW: ToxiC Bug Found By Drago84 Source Code: http://freshmeat.net/redir/phnntp/16290/urltgz/phNNTP-v1.3.tar.gz Problem Is: require"$filenewsportal"; Page Affect: article-raw.php Path: Declare filenewsportal ExP:...
phNNTP <= 1.3 (article-raw.php) Remote File Include Vulnerability
Exploit for unknown platform in category web applications ================================================================= phNNTP = 1.3 article-raw.php Remote File Include Vulnerability ================================================================= phNNTP v1.3 Remote File Inclusion CreW: Toxi...
phNNTP 1.3 - 'article-raw.php' Remote File Inclusion
phNNTP v1.3 Remote File Inclusion CreW: ToxiC Bug Found By Drago84 Source Code: http://freshmeat.net/redir/phnntp/16290/urltgz/phNNTP-v1.3.tar.gz Problem Is: require"$filenewsportal"; Page Affect: article-raw.php Path: Declare filenewsportal ExP:...
Apple Mac OSX 10.4.7 - fetchmail Privilege Escalation
!/bin/sh http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Previously undisclosed local fetchmail issue. This takes setgid=6 http://docs.info.apple.com/article.html?artnum=106704 export PATH=/tmp:$PATH echo /bin/sh -i /tmp/uname chmod +x /tmp/uname /usr/bin/fetchmail -V...
namc10.txt
--------------------------------------------------------------------------------- New Article Mambo Component = 1.0 comarticles.php Remote File Include Vulnerabilities --------------------------------------------------------------------------------- Author : Ahmad Maulana a.k.a Matdhule Date : Ju...
Microsoft Security Bulletin MS06-036 Vulnerability in DHCP Client Service Could Allow Remote Code Execution (914388)
Microsoft Security Bulletin MS06-036 Vulnerability in DHCP Client Service Could Allow Remote Code Execution 914388 Published: July 11, 2006 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Ratin...
CVE-2006-3172
Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...
CVE-2006-2689
Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...
Alstrasoft Article Manager Pro v1.6
Alstrasoft Article Manager Pro v1.6 - XSS & Full Path errors Homepage: http://www.alstrasoft.com Description: Article Manager Pro is the next generation article publishing system designed to make your life a whole lot easier by enabling webmasters to publish articles or news into their website in...
Cross site scripting
Cross-site scripting XSS vulnerability in submitarticle.php in Alstrasoft Article Manager Pro 1.6 allows remote attackers to inject arbitrary web script or HTML when submitting an article, as demonstrated using a javascript URI in a Cascading Style Sheets CSS property of a STYLE attribute of an...
Sql injection
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
Design/Logic Flaw
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
CVE-2006-2567
Cross-site scripting XSS vulnerability in submitarticle.php in Alstrasoft Article Manager Pro 1.6 allows remote attackers to inject arbitrary web script or HTML when submitting an article, as demonstrated using a javascript URI in a Cascading Style Sheets CSS property of a STYLE attribute of an...
CVE-2006-2566
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via 1 a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or 2 a login QUERYSTRING to admin.php without any additional parameters, which reveal the path in...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...
CVE-2006-2566
Affected software: Alstrasoft Article Manager Pro 1.6. The vulnerability is an information disclosure that exposes the path via error messages in two potential inputs: (1) the action parameter in a request to mrarticles.php (possible quote character or invalid value) and (2) a login QUERY_STRING ...
CVE-2006-2567
CVE-2006-2567 is an XSS vulnerability in the Alstrasoft Article Manager Pro 1.6, affecting the submit_article.php handler. The issue arises from unsafely handling user input in a STYLE attribute, enabling an attacker to inject JavaScript via a javascript: URI in a CSS property, potentially compro...
CVE-2006-2565
Affected software: Alstrasoft Article Manager Pro 1.6. The vulnerability is an SQL injection in two parameters: author_id in profile.php and aut_id in userarticles.php. The SQL manipulation may lead to arbitrary SQL execution and, for the aut_id vector, potential resultant path disclosure if the ...
CVE-2006-2565
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via 1 the authorid parameter in profile.php and 2 the autid parameter in userarticles.php. NOTE: the autid vector can produce resultant path disclosure if the SQL manipulati...