CANews.txt

------------------------------------------------------------------ - CANews Remote Multiple Vulnerability - -= http://colander.altervista.org/advisory/CANews.txt =- ------------------------------------------------------------------ -= CodeAvalanche News Version 1.2 =- Omnipresent May 18, 2006...

Cross site scripting

Cross-site scripting XSS vulnerability in addnews.asp in CodeAvalanche News CANews 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field. NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate...

Sql injection

SQL injection vulnerability in default.asp in CodeAvalanche News CANews 1.2 allows remote attackers to execute arbitrary SQL commands via the password field...

CVE-2006-2500

Cross-site scripting XSS vulnerability in addnews.asp in CodeAvalanche News CANews 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field. NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate...

CVE-2006-2499

SQL injection vulnerability in default.asp in CodeAvalanche News CANews 1.2 allows remote attackers to execute arbitrary SQL commands via the password field...

CVE-2006-2499

SQL injection vulnerability in default.asp in CodeAvalanche News CANews 1.2 allows remote attackers to execute arbitrary SQL commands via the password field...

CVE-2006-2499

CVE-2006-2499 affects CodeAvalanche News (CANews) 1.2, where a SQL injection in default.asp via the password field allows remote execution of arbitrary SQL. The linked data list a CVSSv2 base score of 7.5 (HIGH) with NETWORK attack vector, LOW access complexity, and no authentication required, yi...

CVE-2006-2500

CANews 1.2 is affected by a Cross-Site Scripting (XSS) vulnerability in add_news.asp where the Headline field accepts input that can inject arbitrary script/HTML. The root cause is insufficient input sanitization for that field, enabling remote attackers to execute script in a victim’s browser. T...

CVE-2006-2500: Undefined Security Weakness

Cross-site scripting XSS vulnerability in addnews.asp in CodeAvalanche News CANews 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field. NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate...

CVE-2006-2499: Undefined Security Weakness

SQL injection vulnerability in default.asp in CodeAvalanche News CANews 1.2 allows remote attackers to execute arbitrary SQL commands via the password field...

CodeAvalanche News 1.2 - default.asp SQL Injection

CodeAvalanche News 1.2 - default.asp SQL Injection source: https://www.securityfocus.com/bid/18031/info CodeAvalanche News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...

CodeAvalanche News 1.2 - 'default.asp' SQL Injection

source: https://www.securityfocus.com/bid/18031/info CodeAvalanche News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromis...

[SA20171] CodeAvalanche News "password" SQL Injection Vulnerability

TITLE: CodeAvalanche News "password" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA20171 VERIFY ADVISORY: http://secunia.com/advisories/20171/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: CodeAvalanche News 1.x http://secunia.com/product/10033/...