CVE-2008-1635

Directory traversal vulnerability in viewprivate.php in Keep It Simple Guest Book KISGB 5.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the tmptheme parameter. NOTE: 5.1.1 is also reportedly affected...

CVE-2008-1635

Directory traversal vulnerability in viewprivate.php in Keep It Simple Guest Book KISGB 5.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the tmptheme parameter. NOTE: 5.1.1 is also reportedly affected...

CVE-2008-1635

CVE-2008-1635 affects Keep It Simple Guest Book (KISGB) up to version 5.0.0 (and reportedly 5.1.1) via a directory-traversal flaw in view_private.php. The vulnerability arises from a .. path in the tmp_theme parameter, allowing remote attackers to include and execute arbitrary local files. Docume...

CVE-2008-1635: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in viewprivate.php in Keep It Simple Guest Book KISGB 5.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the tmptheme parameter. NOTE: 5.1.1 is also reportedly affected...

KISGB <= (tmp_theme) 5.1.1 Local File Inclusion Vulnerability

No description provided by source. KISGB Keep It Simple Guest Book : Local FiLe Include's tmptheme Version : All Versions Download : http://sourceforge.net/project/showfiles.php?groupid=38585 ---------------------------------------------------------- Exploit coded and founded by Cr@zyKing Date:...

CVE-2008-1404: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the Viso Industry Book 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

CVE-2008-1250

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

CVE-2008-1250: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

XSS in XP Book version 3.0

Hello , I haven't send any new bugs for long time : Vulnerable : XP Book v3.0 coded by http://kuwaitiphp.alruban.net i think their website doesn't work at the moment exploit : open http://www.example.com/xpbook/entry.php then type in Name: 'scriptalertxss;/script Email : [email protected]...

Design/Logic Flaw

lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...

CVE-2008-0807

CVE-2008-0807 affects Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, deployed in Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5. The flaw in lib/Driver/sql.php fails to properly check access rights, allowing remote authenticated use...

CVE-2008-0294

Unspecified vulnerability in the seat-locking implementation in FreeSeat before 1.1.5d allows attackers to book a seat more than once via unspecified vectors...

Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities

CVE-2007-4708 CVE-2007-4709 CVE-2007-4710 CVE-2007-5847 CVE-2007-5848 CVE-2007-5849 CVE-2007-5850 CVE-2007-5851 CVE-2007-5853 CVE-2007-5854 CVE-2007-5855 CVE-2007-5856 CVE-2007-5857 CVE-2007-5859 CVE-2007-5876 CVE-2007-5860 CVE-2007-5861 These issues affect Mac OS X and various applications,...

CVE-2007-4708

Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler...

CVE-2007-4708

CVE-2007-4708 is a format-string vulnerability in the Address Book component of Apple Mac OS X 10.4.11 that allows remote code execution via the URL handler. Public sources confirm the flaw affects Mac OS X 10.4.11 (and related Address Book/URL handling paths) and indicate that exploitation could...

CVE-2007-4708

Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler...

CVE-2007-4708: Use of Externally-Controlled Format String

Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler...

CodeWidgets Web Based Alpha Tabbed Address Book Index.ASP SQL注入漏洞

CodeWidgets Web Based Alpha Tabbed Address Book是一款基于ASP的WEB应用程序。 CodeWidgets Web Based Alpha Tabbed Address Book不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于'index.asp'脚本对用户提交的'alpha'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 CodeWidgets Web Based Alpha Tabbed Address Book...

wba-sql.txt

http://Aria-Security.Net ------------------------------------ Web based alpha tabbed address book SQL Injection codewidgets.com Poc index.asp?alpha='SQL INJECTION Credits Goes To Aria-Security Team Regards, The-0utl4w...