AZ Photo Album - Cross-Site Scripting / Arbitrary File Upload

source: https://www.securityfocus.com/bid/53641/info The AZ Photo Album is prone to a cross-site-scripting and an arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to steal cookie information, execute arbitrary clie...

CGI Generic Path Traversal (quick test)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local files inclusion vulnerabilities. By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands. %NASLMINLEVEL...

CGI Generic Path Traversal (write test)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities. By leveraging this issue, an attacker may be able to modify arbitrary files on the web server or execute commands. Due to the w...

CGI Generic Path Traversal (extended test)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities. By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands. %NASLMINLEVEL...

CVE-2006-2680

Cross-site scripting XSS vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via the gazpart parameter...

CVE-2006-2680

Cross-site scripting XSS vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via the gazpart parameter...

CVE-2006-2680

CVE-2006-2680 affects the AZ Photo Album Script Pro. The vulnerability is a cross-site scripting (XSS) flaw in the index.php file that allows remote attackers to inject arbitrary web script or HTML via the bad parameter name gazpart. The provided data indicates no explicit exploit code or in-the-...

kapda-22.txt

KAPDA::22 - Azbb v1.1.00 Cross Site Scripting KAPDA New advisory Vulnerable products : Azbb alert'XSS'"" NASL : -------------------- azbb1100XSS.nasl This script was written by Pedram Hayati pi3ch at kapda dot...

CVE-2006-0407

Cross-site scripting XSS vulnerability in post.php in AZ Bulletin Board AZbb 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 nickname parameter and 2 an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a...

Cross site scripting

Cross-site scripting XSS vulnerability in post.php in AZ Bulletin Board AZbb 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 nickname parameter and 2 an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a...

CVE-2006-0407

CVE-2006-0407 affects AZ Bulletin Board (AZbb) 1.1.00 and earlier. The vulnerability is a cross-site scripting (XSS) flaw in post.php, exploitable via the nickname parameter and an iframe tag in the topic parameter, enabling injection of arbitrary HTML/JavaScript by an attacker. The description n...

CVE-2006-0407

Cross-site scripting XSS vulnerability in post.php in AZ Bulletin Board AZbb 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 nickname parameter and 2 an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a...

[SA18565] AZ Bulletin Board Cross-Site Scripting Vulnerabilities

TITLE: AZ Bulletin Board Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA18565 VERIFY ADVISORY: http://secunia.com/advisories/18565/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: AZ Bulletin Board AZbb 1.x http://secunia.com/product/4938/ DESCRIPTIO...

CVE-2005-1201

Multiple directory traversal vulnerabilities in AZ Bulletin board AZbb before 1.0.08 allow 1 remote authenticated users with administrative privileges to delete arbitrary files via a .. dot dot in the URL to adminavatar.php or adminattachment.php or 2 remote attackers to enumerate files via a...

CVE-2005-1200

PHP remote file inclusion vulnerability in mainindex.php in AZ Bulletin Board AZbb 1.0.07a through 1.0.07c allows remote attackers to execute arbitrary PHP code by modifying the 1 dirsrc or 2 abslayer parameter to reference a URL on a remote web server that contains the code...

CVE-2005-1201

Summary: CVE-2005-1201 affects AZ Bulletin Board (AZBB) prior to version 1.0.08. The issue comprises two directory traversal flaws: (1) restricted to remote authenticated admin users who can delete arbitrary files via a “..” in the URL to admin_avatar.php or admin_attachment.php; (2) remote attac...

CVE-2005-1201

Multiple directory traversal vulnerabilities in AZ Bulletin board AZbb before 1.0.08 allow 1 remote authenticated users with administrative privileges to delete arbitrary files via a .. dot dot in the URL to adminavatar.php or adminattachment.php or 2 remote attackers to enumerate files via a...

CVE-2005-1200

PHP remote file inclusion vulnerability in mainindex.php in AZ Bulletin Board AZbb 1.0.07a through 1.0.07c allows remote attackers to execute arbitrary PHP code by modifying the 1 dirsrc or 2 abslayer parameter to reference a URL on a remote web server that contains the code...

CVE-2005-1200

AZ Bulletin Board (AZBB) < 1.0.07d is affected by a PHP remote file inclusion in main_index.php (AZBB 1.0.07a–c) via dir_src or abs_layer parameters, enabling arbitrary PHP code execution on a remote server. The official CVE entry (CVE-2005-1200) documents RSF/URL-based code inclusion in AZBB....