Kayako eSupport 2.x - Ticket System Multiple SQL Injections

Kayako eSupport 2.x - Ticket System Multiple SQL Injections source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise...

Kayako eSupport 2.x - Ticket System Multiple SQL Injections

source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise of software and database security properties. Possible...

[NT] DUGallery Database disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2004-1724

The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusionadmin/dbbackups directory to world read/write/execute 777, which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator userna...

osTicket setup.php Accessibility

The target is running at least one instance of an improperly secured installation of osTicket and allows access to setup.php. Since that script does not require authenticated access, it is possible for an attacker to modify osTicket's configuration using a specially crafted call to setup.php to...

CVE-2003-1304

EarlyImpact ProductCart 1.0 through 2.0 stores database/EIPC.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information via a direct request...

DUWare Multiple Products - Multiple Vulnerabilities

DUWare Multiple Products - Multiple Vulnerabilities DUWare Multiple Vulnerabilities Vendor: DUWare Product: DUWare Version: Multiple Products Website: http://www.duware.com/ BID: 9246 Description: DUportal Pro is a professional Web portal and online community. DUportal Pro contains numerous...

DUWare Multiple Products - Multiple Vulnerabilities

DUWare Multiple Vulnerabilities Vendor: DUWare Product: DUWare Version: Multiple Products Website: http://www.duware.com/ BID: 9246 Description: DUportal Pro is a professional Web portal and online community. DUportal Pro contains numerous advanced features such as Web-based administration,...

ProductCart 1.5/1.6/2.0 - File Disclosure

source: https://www.securityfocus.com/bid/8112/info A vulnerability has been reported for ProductCart that may result in an attacker obtaining the contents of the database file. http://victimhost/productcart/database/EIPC.mdb...

ProductCart 1.5/1.6/2.0 - 'Custva.asp' SQL Injection

source: https://www.securityfocus.com/bid/8103/info ProductCart has been reported prone to an SQL injection vulnerability that may be exploited to reveal information relating to the underlying database; other attacks may also be possible...

ProductCart 1.51.62.0 - Custva.asp SQL Injection

ProductCart 1.51.62.0 - Custva.asp SQL Injection source: https://www.securityfocus.com/bid/8103/info ProductCart has been reported prone to an SQL injection vulnerability that may be exploited to reveal information relating to the underlying database; other attacks may also be possible...

Viewpoint Server

------------------------------- Application: Viewpoint Server Vendor: DS Ltd Language: Shell OS: Unixes Discovered: Ben Maynard bmaynardatvoodooxdotnet ------------------------------- Application Description: Viewpoint server is a web application that allow users to view catalogs at their local...

PostNuke Members_List Module Information Disclosure

The remote host is running PostNuke. It is possible to use the CMS to determine the full path to its installation on the server or the name of the database used, by doing a request like : /modules.php?op=modload&name=MembersList&file=index&letter=All&sortby=foobar An attacker may use these flaws ...

SimpleBBS 1.0.6 Default Permissions Vuln

SimpleBBS 1.0.6 Security Problem: User database stored in a php file that's readable by anyone. http://www.tareget.com/simplebbs/users/users.php Passwords are md5'ed, but user data is not. The vendor was notified and has released updates. FluRDoInG [email protected] http://www.flurnet.org KEY ID...

Code Injection in phpBB Advanced Quick Reply Mod

Software: phpBB Advanced Quick Reply Mod I've found a security hole in this sofware Code Injection. You can download this software at http://phpbbhacks.com/viewhack.php?id=586 Hackers can exploit this Mod to inject some shell code to hack your forum, your website or your server local exploit...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities

source: https://www.securityfocus.com/bid/4957/info It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute script code within the context of the site as an authenticated...

Possible Issue with Netinfo and Mac OS X

Hi, I have been using Mac OS X for quite a while now, and I have just found something that concerns me a little. As you probably know Mac OS X is based on BSD and by default does not have any services running though it is not hard to turn these on thefore is reasonably secure out of the box. Now ...

extent technologies rbs isp 2.5 - Directory Traversal

extent technologies rbs isp 2.5 - Directory Traversal source: https://www.securityfocus.com/bid/1704/info A remote user is capable of gaining read access to any file residing in the same directory of a host running Extent RBS ISP through directory traversal. Appending '../' to the 'image' variabl...

SRADV00001.txt

================================================= Secure Reality Pty Ltd. Security Advisory 1 SRADV00001 http://www.securereality.com.au ================================================= Title Arbitrary file disclosure through PHP file upload Released 04/09/2000 We found this particular issue a...