969 matches found
Design/Logic Flaw
WHMCompleteSolution WHMCS before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified "incorrect permissions." However, the vendor...
CVE-2006-0652
WHMCompleteSolution WHMCS before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified "incorrect permissions." However, the vendor...
[Full-disclosure] -moz-binding CSS property: more XSS fun
Hm, I haven't seen this posted here ... Firefox now supports the -moz-binding CSS property, which associate XBL1 with an element. The same origin policy is not applied. This is a problem because XBL may contain JavaScript and it runs with full access to content. There is a bug report2 filed, but ...
cubecartXSS.txt
CubeCart 3.0.7-pl1 multiple variable Cross site scripting Vendor url: www.cubecart.com bug report:http://bugs.cubecart.com/?do=details&id=459 Advisore:http://lostmon.blogspot.com/2006/01/ cubecart-307-pl1-indexphp-multiple.html. vendor notify:yes exploit avalable: yes I recomended to all vendors ...
MyBB 1.0.2 SQL injection in usercp.php
this is a bug report for MyBB 1.0.2latest version bug found by imei there is a security bug in usercp.php line 830 that Allows SQL Injection and can result to full access to admin cp. bug is in result of poor checking of $mybb-input'threadmode' value against all other values in usercp.php file...
NetBSD Security Advisory 2006-002: settimeofday() time wrap
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2006-002 ================================= Topic: settimeofday time wrap Version: NetBSD-current: source prior to December 5, 2005 NetBSD 3.0: not affected NetBSD 2.1: affected NetBSD 2.0.3: affected NetBSD 1.6.2: affected...
[Full-disclosure] php < 4.4.1 htaccess apache dos
Hello, Here under some stuff to dos apache + php just through an htaccess. With .htaccess method : If you have into your php.ini - safemode = On Simply put a .htaccess file on the root directory of your website with this content : phpvalue session.savepath /var/www/somewherehowexist Apache segfau...
CVE-2005-0023
gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...
cubecart-3.0.3.txt
CubeCart 3.0.3 multiple variable Cross site scripting Vendor url: www.cubecart.com bug report:http://bugs.cubecart.com/?do=details&id=363 Advisore:http://lostmon.blogspot.com/2005/09/ cubecart-303-multiple-variable-cross.html vendor confirmed: yes exploit avalable: yes Fix available: yes CubeCar...
runcms highlight.php hole
This is a stupid BUG report. They found the bug without checking the script or they know but dont said about it to promote their group. The truth is the script is allow only user that have the right to access the "systems" module to use it, this mean only admin and some moderators/users that have...
[Full-disclosure] mutt buffer overflow
Summary/Impact: There is a buffer overflow in mutt found thanks to ProPolice, which may allow an attacker to execute code by sending a maliciously crafted email. All latest versions appear affected. Mutt is an e-mail client that sucks less according to the headline on http://www.mutt.org/ Details...
CVE-2005-1581
Vulnerability summary: CVE-2005-1581 describes a cross-site scripting (XSS) flaw in Bug Report 1.0. User input from various fields to bug_report.php is not filtered or quoted when processed by bug_list.php or admin/index.php, allowing remote attackers to inject arbitrary web script or HTML. What’...
CVE-2005-1581
Cross-site scripting XSS vulnerability in Bug Report 1.0 allows remote attackers to inject arbitrary web script or HTML via various fields to bugreport.php, which are not filtered or quoted when processed by buglist.php or admin/index.php...
CVE-2005-1581
Cross-site scripting XSS vulnerability in Bug Report 1.0 allows remote attackers to inject arbitrary web script or HTML via various fields to bugreport.php, which are not filtered or quoted when processed by buglist.php or admin/index.php...
CVE-2005-1581: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Bug Report 1.0 allows remote attackers to inject arbitrary web script or HTML via various fields to bugreport.php, which are not filtered or quoted when processed by buglist.php or admin/index.php...
[SA14820] Mozilla Firefox JavaScript Engine Information Disclosure Vulnerability
---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Mozilla Firefox JavaScript Engine Information Disclosu...
phpMyFamily140.txt
ADZ Security Team =================== Info Program: phpMyFamily Version: 1.4.0 Modules: people.php, track.php, edit.php, document.php, census.php, passthru.php and other.. Bug type: SQL Injection Vendor site: http://www.phpmyfamily.net/ Vendor Informed: Yes =================== Bug Info Basic...
HashCash antispam token generation utility format tring bug
From: e-mail message header format string bug...
CVE-2005-0625
CVE-2005-0625 affects reportbug 3.2, where settings from .reportbugrc are included in bug reports, exposing sensitive data such as smtpuser and smtppasswd. The underlying issue is the unintended leakage of stored mail credentials via bug reports. The impact is credential exposure; the available s...
paNews_v2.0b4.txt
oooo oooo oooooooo8 ooooooooooo 8888o 88 888 88 888 88 88 888o88 888oooooo 888 88 8888 888 888 o88o 88 o88oooo888 o888o Network security team nst.e-nex.com Title: paNews v2.0b4 Bug found by: ò¸ìû÷ Date: 20.02.2005 web: http://www.phparena.net/panews.php google: allintitle:paNews v2.0b4 PHP...