Claroline 1.x - '/inc/lib/language.lib.php?language' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/25521/info Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities. An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which m...

yemao cms3.2 info_zoom.php SQL injection Vulnerability

Vulnerable file : infozoom.php Exploit : Thx : All the kidz of cnsst.org 过滤不严,造成SQL注入漏洞 ymCMS 3.2.0 http://www.yemao.com官方已经更新建议先删掉这个文件,等官方补丁 http://www.yemao.com/infozoom.php?sortid=1%20and%201=2%20union%20select%201,concatusername,0x5f,password,3,4,5,6,7%20from%20user%20where%20userid=1/...

US-CERT Technical Cyber Security Alert TA07-199A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-199A Mozilla Updates for Multiple Vulnerabilities Original release date: July 18, 2007 Last revised: -- Source: US-CERT Systems Affected Mozilla Firefox Mozilla Thunderbird Other products...

Microsoft Windows Vista/2003/XP/2000 file management security issues

Title: Microsoft Windows Vista/2003/XP/2000 file management security issues Author: 3APA3A, http://securityvulns.com/ Vendor: Microsoft and potentially another vendors Products: Microsoft Windows Vista/2003/XP/2000, Microsoft resource kit for Windows 2000 and different utilities. Access Vector:...

[waraxe-2007-SA#051] - Sql Injection in 2z Project 0.9.5

waraxe-2007-SA051 - Sql Injection in 2z Project 0.9.5 ==================================================================== Author: Janek Vind "waraxe" Date: 23. May 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-51.html Target software description: Vulnerable: 2z Project 0.9.5...

DEBIAN-CVE-2007-2383

The Prototype prototypejs framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and...

PT-2007-3711 · Google · Google Web Toolkit

Name of the Vulnerable Software and Affected Versions: Google Web Toolkit GWT affected versions not specified Description: The issue concerns the exchange of data using JavaScript Object Notation JSON without proper protection, allowing remote attackers to obtain the data. This can be achieved...

PT-2007-3712 · Jquery · Jquery

Name of the Vulnerable Software and Affected Versions: jQuery affected versions not specified Description: The issue allows remote attackers to obtain data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript...

linux-dccp.txt

Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...

[Full-disclosure] Linux Kernel DCCP Memory Disclosure Vulnerability

Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...

PHPX 3.5.15/3.5.16 - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/23033/info PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitra...

GLSA-200703-10 : KHTML: XSS (XSS) vulnerability

The remote host is affected by the vulnerability described in GLSA-200703-10 KHTML: XSS XSS vulnerability The KHTML code allows for the execution of JavaScript code located inside the 'Title' HTML element, a related issue to the Safari error found by Jose Avila. Impact : When viewing a HTML page...

Mozilla products allows the src attribute in an img element to be changed to a JavaScript URI

Overview Mozilla products contain a cross-site scripting vulnerability due to a vulnerability in the way IMG elements are loaded. Description A vulnerability in the way Mozilla products load IMG elements in a frame may cause a cross-site script injection. According to Mozilla Foundation Security...

CVE-2007-0096

CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb...

For the domestic Enterprise Security ten vulnerabilities-vulnerability warning-the black bar safety net

The growing dependence on Internet applications in the modern enterprise, evolving security threats and changing regulatory standards so that the maintenance of a trusted network environment becomes a major problem. In today's global economic environment, the company enterprise has never been...

LandShop 0.6.3 - ls.php Multiple SQL Injections

LandShop 0.6.3 - ls.php Multiple SQL Injections source: https://www.securityfocus.com/bid/20989/info LandShop is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues could allow an attacker to steal...

Roller Weblogger contains a cross-site scripting vulnerability

Overview A cross-site scripting vulnerability in Roller Weblogger may allow an attacker to read or modify data in web pages and cookies. Description There is a cross-site scripting vulnerability in the way that Roller handles data supplied in the comments section of a web page running the Roller...

CubeCart 3.0.x - '/admin/print_order.php?order_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of...

phpMyAdmin 2.x - Multiple Script Array Handling Full Path Disclosures

phpMyAdmin 2.x - Multiple Script Array Handling Full Path Disclosures source: https://www.securityfocus.com/bid/21137/info phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure...

phpMyAdmin 2.x - 'sql.php?pos' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21137/info phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities. An attacker could exploit these vulnerabilities to vi...