infinsql.txt

product:Infinitytechs Restaurants CM bug:injection sql risk:medium injection sql: /rating.asp?id='sql /mealrest.asp?mealid='sql /resdetails.asp?resid='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

Aspmforum [ multiples injection sql (get&post)]

vendor site:http://www.kervancilar.com/ product:Aspmforum bug:injection sql get & post risk:high injection sql get : /forum.asp?baslik='sql /forum2.asp?baslik=2&soruid='sql /kullanicilistesi.asp?ak=&at=&harf='sql /kullanicilistesi.asp?at=baslayan&ak='sql once logged :...

2020realest.txt

vendor site:http://www.2020applications.com/ product:20/20 real estate bug:injection sql risk:high injection sql get : /listings.asp?itemID='sql /listings.asp?peopleID='sql /f-googleearth.asp?itemID='sql /f-email.asp?strPeopleID=1&itemID='sql...

candypress.txt

vendor site:http://www.candypress.com/ product:CandyPress Store bug:injection sql risk:medium injection sql get : http://site.com/sa3.5.2.14/scripts/openPolicy.asp?policy='sql http://site.com/sa3.5.2.14/scripts/prodList.asp?brand='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact:...

carsite.txt

Car Site Manager injection sql & xss get vendor site:http://www.mginternet.com/ product:Car Site Manager bug:injection sql risk:medium injection sql : http://site.com/csm/asp/detail.asp?l=&p='sql http://site.com/csm/asp/listings.asp?l='sql http://site.com/csm/asp/listings.asp?s=search&typ='sql...

Property Site Manager [login bypass ,multiples injection sql & xss (get)]

vendor site:http://www.mginternet.com/ product:Property Site Manager bug:injection sql ,login bypass , xss risk:medium login bypass : just login with : user: 'or''=' passwd: 'or''=' injection sql : http://site.com/asp/detail.asp?l=&p='sql http://site.com/asp/listings.asp?l='sql...

Dragon calendar [ login bypass & injection sql ]

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffie & benjam...

speedwiki20.txt

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

CVE-2006-5741

Multiple cross-site scripting XSS vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via 1 the 404 error page of the Smart Sensor Edge Sensor; 2 the user name for a failed logon, when displayed in the audit journals reviewin...

CVE-2006-5741

Multiple cross-site scripting XSS vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via 1 the 404 error page of the Smart Sensor Edge Sensor; 2 the user name for a failed logon, when displayed in the audit journals reviewin...

Solaris 6 (sparc) : 110971-22

Sun Management Center 3.0: RR Patch for Solaris 2.6. Date this patch was last updated by Sun : Apr/08/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc...

Debian DSA-960-3 : libmail-audit-perl - insecure temporary file creation

The former update caused temporary files to be created in the current working directory due to a wrong function argument. This update will create temporary files in the users home directory if HOME is set or in the common temporary directory otherwise, usually /tmp. For completeness below is a co...

Debian DSA-1017-1 : kernel-source-2.6.8 - several vulnerabilities

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2004-1017 Multiple overflows exist in the ioedgepor...

Debian DSA-893-1 : acidlab - missing input sanitising

Remco Verhoef has discovered a vulnerability in acidlab, Analysis Console for Intrusion Databases, and in acidbase, Basic Analysis and Security Engine, which can be exploited by malicious users to conduct SQL injection attacks. The maintainers of Analysis Console for Intrusion Databases ACID in...

OpenSSH < 4.4 Multiple Vulnerabilities

Binary data 3751.prm...

OpenSSH < 4.4 Multiple Vulnerabilities

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities : - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that...

CVE-2006-4991

RSA Keon Certificate Authority (KeonCA) Manager versions 6.5.1 and 6.6 are affected. The vulnerability allows local privileged users to hide CA activities by tampering auditor logs: (1) modifying or deleting a and its signature in the XML log without triggering the integrity check on the entire ...

CVE-2006-4991: Undefined Security Weakness

RSA Keon Certificate Authority KeonCA Manager 6.5.1 and 6.6 allows privileged local users to hide malicious Certificate Authority CA activities by modifying CA auditor logs without detection by 1 modifying or deleting a and its signature from the XML log in a way that is not detected by the...

CVE-2006-4901

Computer Associates CA eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts and conduct replay attacks by invoking eTSAPISend.exe with the desired arguments...

CVE-2006-4901: Undefined Security Weakness

Computer Associates CA eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts and conduct replay attacks by invoking eTSAPISend.exe with the desired arguments...