CVE-2010-5009

SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action...

CVE-2010-5009

CVE-2010-5009 affects UTStats Beta 4 and earlier, where index.php is vulnerable to SQL injection via the pid parameter in the matchp action. The issue allows remote attackers to execute arbitrary SQL commands, enabling partial data confidentiality and integrity impact with no authentication and n...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

CiviCRM 3.1 < Beta 5 - Multiple Cross-Site Scripting Vulnerabilities

Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: and from being in the same input box. In several cases it is possible to use multiple input boxes th...

CVE-2008-6971

The password reset functionality in Simple Machines Forum SMF 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify...

CVE-2008-4145

SQL injection vulnerability in userreadlinks.php in Addalink 1.0 beta 4 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categoryid parameter...

CVE-2008-3583

Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long URL in the SRC attribute of an IMG element. NOTE: this might be related to CVE-2008-3360. NOTE: it was later reported that 2.08 Beta 4 is also affected...

Lotus Expeditor cai URI handler command injection

Added: 06/20/2008 CVE: CVE-2008-1965 BID: 28926 OSVDB: 44868 Background Lotus Expeditor is a desktop integration framework used by Lotus products including Lotus Symphony. Problem Lotus Expeditor registers a handler for cai: URIs which passes arbitrary arguments to rcplauncher.exe. This allows...

Design/Logic Flaw

The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values...

Woltlab Burning Board UserGroups.PHP SQL注入漏洞

Woltlab Burning Board是一款基于PHP的WEB应用程序。 Woltlab Burning Board不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'UserGroups.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 Woltlab Burning Board 2.7 Woltlab Burning Board 2.6 Woltlab Burning Board 2.5 Woltlab Burning Board 2.4 Woltlab Burning...

CVE-2002-1967

XiRCON 1.0 Beta 4 is affected by a buffer overflow that can be triggered remotely via overly long (ctcp, primsg, msg, notice) commands, causing denial of service (disconnect). The provided documents describe the impact but do not include exploit details or a patch. Affected component: XiRCON 1.0 ...

paFaq10beta4.txt

GulfTech Security Research June 20th, 2005 Vendor : php Arena URL : http://www.phparena.net/pafaq.php Version : paFAQ 1.0 Beta 4 Risk : Multiple Vulnerabilities Description: paFAQ is a FAQ/Knowledge base system that allows webmasters to keep an organized database of Frequently Asked Questions; a...

CVE-2005-2014

The "upload a language pack" feature in paFAQ 1.0 Beta 4 allows remote authenticated administrators to execute arbitrary PHP commands by uploading a malicious language pack...

CVE-2005-2012

paFAQ 1.0 Beta 4 is affected by multiple SQL injection vulnerabilities in the login flow, allowing remote attackers to bypass authentication by manipulating the (1) username or (2) id parameters. The Nessus plugin and CVE records corroborate that the remote PHP/MySQL application is vulnerable to ...

CVE-2005-2013

The CVE-2005-2013 entry concerns paFAQ 1.0 Beta 4, a PHP/MySQL web application. The described vulnerability allows remote attackers to access admin/backup.php directly, which contains a backup of the database including usernames and passwords. This exposure could reveal administrator credentials ...

CVE-2005-2013

paFAQ 1.0 Beta 4 allows remote attackers to obtain sensitive information via a direct request to admin/backup.php, which contains a backup of the database including usernames and passwords...

CVE-2005-2012

Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 id parameters...

dnstools: authentication bypass vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following authentication bypass vulnerability in dnstools: Details - ------- Product: dnstools Affected Version: 2.0 beta 4 and maybe all versions before Immune Version: 2.0 beta 5 OS affected: Linux only Vendor-URL:...