CVE-2008-1524

The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, has "public" as its default community for both 1 read and 2 write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by readin...

CVE-2008-1524

The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, has "public" as its default community for both 1 read and 2 write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by readin...

CVE-2008-1524

Vulnerability: CVE-2008-1524 affects ZyXEL Prestige routers (P-660, P-661) with firmware 3.40(AGD.2)–3.40(AHQ.3). The SNMP service uses default community names: read and write access are both set to "public", enabling remote administrators actions via SNMP. Documented implications include reading...

[SECURITY] Fedora 7 Update: tomcat5-5.5.26-1jpp.2.fc7

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

Naymz multiple XSS

Naymz is a online profile system with positive and accurate information that you want others to find when they search for you online. Community Search fails to sanitize: 1."scriptalert'xss'/script...

naymz-xss.txt

Naymz is a online profile system with positive and accurate information that you want others to find when they search for you online. Community Search fails to sanitize: 1."alert'xss'...

socialurl-xss.txt

Overview: SocialURL is a social community platform enabling you to organize your online identities. Connnect to all your social network sites with one URL. SocialURL fails to sufficiently sanitize user-supplied input data via login box. Class: Input Validation Error Example: 1.alert'xss' 2...

Bitweaver source code disclosure, arbitrary file upload

WwW.BugReport.ir AmnPardaz Security Research Team Title: Bitweaver R2 CMS Vendor: http://www.bitweaver.org Bugs: source code disclosure, arbitrary file upload Vulnerable Version: 2 prior versions also may be affected Exploitation: Remote with browser Fix Available: No! - Description: Bitweaver is...

Zenphoto 1.1.3 (rss.php albumnr) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================= Zenphoto 1.1.3 rss.php albumnr Remote SQL Injection Exploit ============================================================= !/usr/bin/perl -w Zenphoto 1.1.3 SQL Injection Exploit...

Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities ================================================================ WwW.BugReport.ir AmnPardaz Security Research...

XZeroScripts XZero Community Classifieds SQL注入漏洞

BUGTRAQ ID: 27042 CNCAN ID:CNCAN-2007122807 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 XZeroScripts XZero Community...

XZeroScripts XZero Community Classifieds 'config.inc.php'远程文件包含漏洞

BUGTRAQ ID: 27040 CNCAN ID:CNCAN-2007122806 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'config.inc.php'脚本对用户提交的'pathescape'参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 XZeroScripts XZero...

XZeroScripts XZero Community Classifieds 本地文件包含漏洞

BUGTRAQ ID: 27041 CNCAN ID:CNCAN-2007122808 XZeroScripts XZero Community Classifieds是一款基于PHP的WEB应用程序。 XZeroScripts XZero Community Classifieds不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交包含多个\"../\"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 XZeroScripts XZero Community...

Directory traversal

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagename parameter in a page view action...

CVE-2007-6567

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pagename parameter in a page view action...

CVE-2007-6568

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathescape parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathescape parameter...

CVE-2007-6566

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php...

Sql injection

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php...

CVE-2007-6566

CVE-2007-6566 describes an SQL injection in post.php of XZero Community Classifieds 4.95.11 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php. The NVD entry lists a CVSS v2 base score of 7.5 (High). No exploitation det...