Article Dashboard - adminlogin.php Multiple SQL Injections

Article Dashboard - adminlogin.php Multiple SQL Injections source: https://www.securityfocus.com/bid/27286/info Article Dashboard is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful...

Article Dashboard - '/admin/login.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/27286/info Article Dashboard is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Security vulnerability with Dashboard spacesSelectedTab

Our security team has reported the following vulnerability, which must be resolved for us to use the application. Severity: High Test Type: Application Vulnerable URL: https://gforgewiki.nci.nih.gov/dashboard.action Parameter = spacesSelectedTab Remediation Tasks: Filter out hazardous characters...

Security vulnerability with Dashboard spacesSelectedTab

Our security team has reported the following vulnerability, which must be resolved for us to use the application. Severity: High Test Type: Application Vulnerable URL: https://gforgewiki.nci.nih.gov/dashboard.action Parameter = spacesSelectedTab Remediation Tasks: Filter out hazardous characters...

Security vulnerability with Dashboard spacesSelectedTab

Our security team has reported the following vulnerability, which must be resolved for us to use the application. Severity: High Test Type: Application Vulnerable URL: https://gforgewiki.nci.nih.gov/dashboard.action Parameter = spacesSelectedTab Remediation Tasks: Filter out hazardous characters...

hc-multi.txt

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Some more widgets: Facebook, Hockey, FlickrInterestingNess (Re: [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets)

This is a follow-up to 0 and 1. Last night, I wrote: It would probably be an interesting exercise to go through some more dashboard widgets and grep for eval. I'd bet quite a bit that there's much more out there. - The top-50 facebook widget 2 uses the AllowFullAccess configuration option, which...

[MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets

Twitgit 1 and Twitterlex 2 are two MacOS X Dashboard widgets developed in JavaScript that can be used to display twitter.com updates. Both regularly retrieve data using the Twitter JSON API and parse whatever is returned with eval. Both relax the dashboard's JavaScript sandbox to enable the...

Recently updated links for users with personal spaces link to profile if personal space is not accessible

Users without the global access right for personal space can still see links to personal spaces in the "Recently updated" list on their dashboard. This is a serious security problem for extranets, when one wants to prevent non anonymous external users to see who's using the wiki. Note: this probl...

CVE-2007-4332

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

Sql injection

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-4333

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-4333

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-4333

CVE-2007-4333 describes multiple cross-site scripting (XSS) vulnerabilities in signup.php of Article Dashboard. The issue allows remote attackers to inject arbitrary web script or HTML via the parameters f_emailaddress, f_reemailaddress, and other unspecified fields. Connected sources corroborate...

CVE-2007-4332

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-4332

CVE-2007-4332 is a SQL injection vulnerability in Article Dashboard’s article.php. When magic_quotes_gpc is disabled, remote attackers can inject arbitrary SQL commands through the id parameter during a print action. The vulnerability is described across multiple sources (NVD/NVDB-derived and thi...

CVE-2007-4332: Undefined Security Weakness

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

[security bulletin] HPSBMA02245 SSRT061260 rev.1 - HP OpenView Dashboard Running Shared Trace Service, Remote Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01114156 Version: 1 HPSBMA02245 SSRT061260 rev.1 - HP OpenView Dashboard Running Shared Trace Service, Remote Arbitrary Code Execution NOTICE: The information in this Security Bulletin should be...

CVE-2007-4333: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...