CVE-2006-3385

Cross-site scripting XSS vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script or HTML via the 1 id and 2 disabled parameters...

Sql injection

SQL injection vulnerability in index.php in DGBook 1.0, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 homepage, 4 address, 5 comment, and 6 ip parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-2544

CVE-2006-2544 affects Xtreme Topsites 1.1 with magic_quotes_gpc disabled, allowing remote attackers to trigger SQL injection through two parameters: searchthis in lostid.php and id in stats.php. The vulnerability enables arbitrary SQL execution and has a NVD base score of 5.1 (Medium) with networ...

CVE-2006-1520

Format string vulnerability in ANSI C Sender Policy Framework library libspf before 1.0.0-p5, when debugging is enabled, allows remote attackers to execute arbitrary code via format string specifiers, possibly in an e-mail address...

FreeBSD : mambo -- 'register_globals' emulation layer overwrite vulnerability (ffb82d3a-610f-11da-8823-00123ffe8333)

A Secunia Advisory reports : peter MC tachatte has discovered a vulnerability in Mambo, which can be exploited by malicious people to manipulate certain information and compromise a vulnerable system. The vulnerability is caused due to an error in the 'registerglobals' emulation layer in...

CVE-2006-2344

SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the ubild parameter...

CVE-2006-2344

The CVE-2006-2344 issue affects AliPAGER 1.5, with a SQL injection in inc/elementz.php via the ubild parameter when magic_quotes_gpc is disabled. Root cause is improper input handling enabling arbitrary SQL execution. Impact per available data: partial confidentiality and partial integrity; no av...

coppermine -- "file" Local File Inclusion Vulnerability

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the "file" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary...

[SA19637] RateIt "rateit_id" SQL Injection Vulnerability

TITLE: RateIt "rateitid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19637 VERIFY ADVISORY: http://secunia.com/advisories/19637/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: RateIt 2.x http://secunia.com/product/9357/ DESCRIPTION: Aliaksandr...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party ALP, allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including 1 ase.php, 2 devi.php, 3 doom3.php,...

Sql injection

Multiple SQL injection vulnerabilities in akocomment.php in AkoComment 2.0 module for Mambo, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the 1 acname or 2 contentid parameter...

Don't send any notifications to disabled users

Once a user is disabled, they should not receive any notifications...

Don't send any notifications to disabled users

Once a user is disabled, they should not receive any notifications...

Don't send any notifications to disabled users

Once a user is disabled, they should not receive any notifications...

CVE-2006-1237

Multiple SQL injection vulnerabilities in DSNewsletter 1.0, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the email parameter to 1 include/sub.php, 2 include/confirm.php, or 3 include/unconfirm.php...

WordPress2.0.0-autorswebsite.txt

original advisory ——————-Summary—————- Software: WordPress Sowtware’s Web Site: http://www.wordpress.org Versions: 2.0.0 Class: Remote Status: Unpatched Exploit: Available Solution: Available Discovered by: imei addmimistrator Risk Level: Low —————–Description————— There is some security bug in...

Design/Logic Flaw

The 1 addfolder and 2 deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled...

CVE-2005-4715

CVE-2005-4715 concerns multiple SQL injection vulnerabilities in PHP-Nuke 7.8. The flaw occurs in modules.php when magic_quotes_gpc is disabled, allowing remote attackers to inject arbitrary SQL via the POST parameters (name, sid, pid) that bypass security checks applied to GET requests. Affected...

Ubuntu 4.10 / 5.04 : gnupg vulnerability (USN-170-1)

Serge Mister and Robert Zuccherato discovered a weakness of the symmetrical encryption algorithm of gnupg. When decrypting a message, gnupg uses a feature called 'quick scan'; this can quickly check whether the key that is used for decryption is probably the right one, so that wrong keys can be...

CVE-2005-3538

hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges...