phpmyadmin -- XSRF vulnerabilities

phpMyAdmin security team reports: It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link. Such issue is quite common in many PHP applications and users should take care what links they follow. We consider these vulnerabilities to be quite...

Design/Logic Flaw

ircpio.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session...

CVE-2006-2366

ircpio.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session...

SaphpLesson 2.0 (forumid) Remote SQL Injection Exploit

--------------------------------------------------------------------------- SaphpLesson 2.0 forumid Remote SQL Injection Exploit --------------------------------------------------------------------------- Discovered By SnIpErSA Author : SnIpErSA Exploit in Perl :...

[eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities

New eVuln Advisory: QLnews XSS and PHP Code Insertion Vulnerabilities http://evuln.com/vulns/113/summary.html --------------------Summary---------------- eVuln ID: EV0113 CVE: CVE-2006-1575 CVE-2006-1576 Software: QLnews Sowtware's Web Site: http://www.vscripts.pl/ Versions: 1.2 Critical Level:...

[UNIX] FACE CONTROL CMS vis.pl Directory Traversal

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

EV0089.txt

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

[eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities

New eVuln Advisory: ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/87/summary.html --------------------Summary---------------- eVuln ID: EV0087 CVE: CVE-2006-0940 CVE-2006-0941 Software: ShoutLIVE Sowtware's Web Site:...

EV0084.txt

New eVuln Advisory: Skate Board Multimple Vulnerabilities http://evuln.com/vulns/84/summary.html --------------------Summary---------------- eVuln ID: EV0084 CVE: CVE-2006-0809 CVE-2006-0810 CVE-2006-0811 Software: Skate Board Sowtware's Web Site: http://bb.jiraiya.se/main.php?content=start...

EV0082.txt

New eVuln Advisory: Leif M. Wright's Blog Multiple Vulnerabilities http://evuln.com/vulns/82/summary.html --------------------Summary---------------- eVuln ID: EV0082 CVE: CVE-2006-0843 CVE-2006-0844 CVE-2006-0845 CVE-2006 Software: Leif M. Wright's Blog Sowtware's Web Site:...

EV0081.txt

New eVuln Advisory: PerlBlog Multiple Vulnerabilities http://evuln.com/vulns/81/summary.html --------------------Summary---------------- eVuln ID: EV0081 CVE: CVE-2006-0780 CVE-2006-0781 CVE-2006-0782 Software: PerlBlog Sowtware's Web Site: http://www.chronicled.org/perlblog/ Versions: 1.09b 1.09...

CVE-2006-0936

Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00...

EV0072.txt

New eVuln Advisory: Magic News Lite PHP Code Execution & Unauthorized Data Modification http://evuln.com/vulns/72/summary.html --------------------Summary---------------- eVuln ID: EV0072 CVE: CVE-2006-0723 CVE-2006-0724 Vendor: Reamday Enterprises Vendor's Web Site: http://reamdaysoft.com...

[ECHO_ADV_27$2006] Indexu <= 5.0.1 Remote File Inclusion

/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV27$2006 --------------------------------------------------------------------------- ECHOADV27$2006 Indexu = 5.0.1 Remote File Inclusion --------------------------------------------------------------------------- Author : M.Hasran Addahroni...

[eVuln] MyQuiz Arbitrary Command Execution Vulnerability

New eVuln Advisory: MyQuiz Arbitrary Command Execution Vulnerability http://evuln.com/vulns/57/summary.html --------------------Summary---------------- Software: MyQuiz Sowtware's Web Site: http://www.corantodemo.net/ Versions: 1.01 Critical Level: Dangerous Type: Command Execution Class: Remote...

vis.pl.txt

Hackers Center Security Group http://www.hackerscenter.com/ spher3's Security Advisory Multiple transversal bug in vis.pl -------------------------------------------------------------------------- Description: Vis.pl is a perl script which manages files in order to show these; you can find it in...

WebspotBlogging.txt

New eVuln Advisory: WebspotBlogging Authentication Bypass Vulnerability http://evuln.com/vulns/41/summary.html --------------------Summary---------------- Software: WebspotBlogging Sowtware's Web Site: http://www.webspot.co.uk/ Versions: 3.0 Critical Level: Dangerous Type: SQL Injection Class:...

CVE-2006-0236

GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an...

[eVuln] geoBlog SQL Injection Vulnerability

New eVuln Advisory: geoBlog SQL Injection Vulnerability http://evuln.com/vulns/33/summary/bt/ --------------------Summary---------------- Software: geoBlog Sowtware's Web Site: http://sourceforge.net/projects/bitdamaged/ Versions: MOD1.0 Critical Level: Dangerous Type: SQL Injection Class: Remote...

[eVuln] ACal Authentication Bypass & PHP Code Insertion

New eVuln Advisory: ACal Authentication Bypass & PHP Code Insertion --------------------Summary---------------- Software: ACal Sowtware's Web Site: http://acalproj.sourceforge.net/ Versions: 2.2.5 Critical Level: Dangerous Type: PHP Code Execution Class: Remote Status: Unpatched Exploit: Availabl...