DCP-Portal 5.3.1 - calendar.php Cross-Site Scripting

DCP-Portal 5.3.1 - calendar.php Cross-Site Scripting source: https://www.securityfocus.com/bid/7144/info It has been reported that DCP-Portal does not sufficiently filter URI parameters supplied to the DCP-Portal 'calender' script. As a result of this deficiency, it is possible for a remote...

DCP-Portal (PHP)

Informations : °°°°°°°°°°°°°° Version : 5.0.1 Website : http://www.dcp-portal.org Problems : - Include file - Access to users' accounts - Access to the administration PHP Code/ Location : °°°°°°°°°°°°°°°°°°°° The first & second hole will work if registerglobals is ON. /library/editor/editor.php :...

DCP-Portal 5.0.1 - 'editor.php?Root' Remote File Inclusion

source: https://www.securityfocus.com/bid/6525/info DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a...

DCP-Portal 5.0.1 - editor.php?Root Remote File Inclusion

DCP-Portal 5.0.1 - editor.php?Root Remote File Inclusion source: https://www.securityfocus.com/bid/6525/info DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously...

DCP-Portal 5.0.1 - lib.php?Root Remote File Inclusion

DCP-Portal 5.0.1 - lib.php?Root Remote File Inclusion source: https://www.securityfocus.com/bid/6525/info DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously create...

DCP-Portal 5.0.1 - 'lib.php?Root' Remote File Inclusion

source: https://www.securityfocus.com/bid/6525/info DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a...

CVE-2002-0282

DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via 1 a direct request to adduser.php, or via an invalid newlanguage parameter in 2 contents.php, 3 categories.php, or 4 files.php, which leaks the path in an error message...

CVE-2002-0281

Cross-site scripting vulnerability in DCP-Portal 4.2 and earlier allows remote attackers to gain privileges of other portal users by providing Javascript in the job information field to userupdate.php...

CVE-2002-0282

DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via 1 a direct request to adduser.php, or via an invalid newlanguage parameter in 2 contents.php, 3 categories.php, or 4 files.php, which leaks the path in an error message...

CVE-2002-0281

Cross-site scripting vulnerability in DCP-Portal 4.2 and earlier allows remote attackers to gain privileges of other portal users by providing Javascript in the job information field to userupdate.php...

CVE-2002-0281

CVE-2002-0281 concerns a cross-site scripting vulnerability in DCP-Portal 4.2 and earlier . The root cause is that an attacker can inject JavaScript in the job information field submitted to the endpoint user_update.php , potentially allowing escalation of privileges to other portal users. The in...

CVE-2002-0282

DCP-Portal versions 3.7–4.5 contain an information disclosure vulnerability that allows remote attackers to obtain the server’s physical path. The issue occurs when an empty request to add_user.php is made, or via an invalid new_language parameter in contents.php, categories.php, or files.php, ca...

CVE-2002-0281: Undefined Security Weakness

Cross-site scripting vulnerability in DCP-Portal 4.2 and earlier allows remote attackers to gain privileges of other portal users by providing Javascript in the job information field to userupdate.php...

CVE-2002-0282: Undefined Security Weakness

DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via 1 a direct request to adduser.php, or via an invalid newlanguage parameter in 2 contents.php, 3 categories.php, or 4 files.php, which leaks the path in an error message...

[ARL02-A03] DCP-Portal Cross Site Scripting Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A03 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : DCP-Portal Cross Site Scripting...

[ARL02-A02] DCP-Portal Root Path Disclosure Vulnerability

+/--------------- ALPER Research Labs -----/--------/+ +/--------------- Security Advisory ----/---------/+ +/--------------- ID: ARL02-A02 ---/----------/+ +/--------------- [email protected] --/-----------/+ Advisory Information -------------------- Name : DCP-Portal Root Path Disclosure...