4693 matches found
comasp.pl.txt
This is a multi-part message in MIME format. ------=NextPart000003901C5473D.C6C4A380 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 !/usr/bin/perl use IO::Socket; use Getopt::Std; print "xASP NUKE 0.80 and below Comments.asp Sql Injection Exploit\n"...
PT-2005-2753 · Zongg · Zongg
Name of the Vulnerable Software and Affected Versions: ZonGG version 1.2 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the password parameter in the "ad/login.asp" endpoint. Recommendations: For ZonGG version 1.2, avoid using th...
Hosting Controller < 6.1 Hotfix 2.1 Multiple Vulnerabilities
According to its version number, the version of Hosting Controller on the remote host suffers from multiple vulnerabilities: - An authenticated user can modify another user's profile, even an admin's, recover his/her password, and then gain access to the affected application as that user. - An...
CVE-2004-2123
The CVE-2004-2123 entry describes multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine. The issues allow remote attackers to inject arbitrary script/HTML via (1) the level parameter of productdetail.asp, (2) the searchKey parameter of searchresults.asp, and p...
CVE-2004-2123
Multiple cross-site scripting XSS vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the 1 level parameter of productdetail.asp, 2 searchKey parameter of searchresults.asp, and possibly 3 level parameter of ListCategories.asp...
Episodex Guestbook Multiple Vulnerabilities (Auth Bypass, XSS)
The remote host is running the Episodex Guestbook, a guestbook written in ASP. The version of Episodex installed on the remote host does not validate input to various fields in the 'default.asp' script before using it to generate dynamic HTML. Additionally, an unauthenticated, remote attacker can...
ASP-DEv XM Forum post.asp IMG Tag XSS
The remote host appears to be running the ASP-DEV XM Forum. There is a flaw in the remote software that may allow anyone to inject arbitrary HTML and script code through the BBCode IMG tag to be executed in a user's browser within the context of the affected web site. %NASLMINLEVEL 70300 This...
PHP, ASP, CGI web applications security vulnerabilities
PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...
CVE-2005-1573
SQL injection vulnerability in adminlogin.asp for ASP Virtual News Manager allows remote attackers to execute arbitrary SQL commands via the password parameter...
CVE-2005-1573
Vulnerability summary (CVE-2005-1573) : The issue affects the ASP Virtual News Manager, specifically the admin_login.asp endpoint. It is a SQL injection vulnerability that allows remote attackers to craft input via the password parameter to execute arbitrary SQL commands on the backend database. ...
[SA15346] ASP Virtual News Manager "password" SQL Injection Vulnerability
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: ASP Virtual News Manager "password" SQL Injection...
[HSC Security Group] MaxWebPortal - Multiple SQL injection/XSS
Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: Maxwebportal 1.3.5 and prior Risk: High MaxWebPortal is probably the most spread ASP based web portal script. I've found multiple XSS and Sql injection that could easily lead to password strealing or porta...
CVE-2005-1573
SQL injection vulnerability in adminlogin.asp for ASP Virtual News Manager allows remote attackers to execute arbitrary SQL commands via the password parameter...
CVE-2004-1788
ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to main.mdb...
CVE-2004-1788
ASP-Nuke 1.3 and earlier stores user credentials under the web document root with insufficient access control. This allows remote attackers to obtain sensitive information via a direct request to main.mdb. The issue is described across multiple sources (NVD/Red Hat/CVE listings) as a vulnerabilit...
PHP, ASP, CGI web applications security vulnerabilities
PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...
[HSC Security Group] ASP Inline Corporate Calendar SQL injection
Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: SQL injection : ASP Inline Corporate Calendar Risk: Medium The Corporate Calendar is a nice asp script to manage a calendar shared by users. It has been downloaded by thousands people, and it is considered...
MidiCart PHP - 'Item_List.php?SecondGroup' SQL Injection
source: https://www.securityfocus.com/bid/13514/info MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or modify data...
[SA15239] ASP Inline Corporate Calendar "Event_ID" SQL Injection
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: ASP Inline Corporate Calendar "EventID" SQL Injection...
[NT] YusASP Web Asset Manager Vulnerability
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...