CVE-2006-0726

CVE-2006-0726 is an XSS vulnerability in linking.php of CPG-Nuke Dragonfly CMS 9.0.6.1. The issue allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users. Affected component: linking.php within Dragonfly CMS 9.0.6.1. The conn...

CVE-2006-0726

Cross-site scripting XSS vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users...

CVE-2006-0727

CVE-2006-0727 describes a SQL injection in mstrack.php of MusOX DF MSAnalysis (DFMSA), used with CPG-Nuke Dragonfly CMS. An attacker can trigger path disclosure via a SQL syntax error and may be able to execute arbitrary SQL commands. The affected software is MusOX DF MSAnalysis as used in Dragon...

Directory traversal

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CVE-2006-0644

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CVE-2006-0644

Dragonfly CMS (CPG-Nuke) 9.0.6.1 contains multiple directory traversal vulnerabilities in install.php that allow remote attackers to include and execute arbitrary local files. The issue arises from insufficient validation of the newlang parameter and the installlang cookie, which can be exploited...

CVE-2006-0644

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

Dragonfly CMS install.php newlang Parameter Local File Inclusion

The remote host appears to be running Dragonfly / CPG-Nuke CMS, a content management system written in PHP. The installed version of Dragonfly / CPG-Nuke CMS fails to validate user input to the 'getlang' parameter as well as the 'installlang' cookie before using them in the 'install.php' script i...

CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion

?php ---dragonfly9.0.6.1inclxpl.php 20.15 07/02/2006 CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion - Sun-Tzu Drangonfly killing - coded by rgod site: http://retrogod.altervista.org - this works regardless of magicquotesgpc settings Sun-Tzu: "Thus it may be...

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution this works regardless of magicquotesgpc settings Sun-Tzu: "Thus it may be known that the leader of armies is the arbiter of the people's fate, the man on whom it depends whether the nation shall be in peace or in peril." / a short explaination:...

CPGNuke Dragonfly 9.0.6.1 Remote Commands Execution Exploit

Exploit for unknown platform in category web applications =========================================================== CPGNuke Dragonfly 9.0.6.1 Remote Commands Execution Exploit =========================================================== this works regardless of magicquotesgpc settings Sun-Tzu:...

CPGNuke Dragonfly 9.0.6.1 Remote Commands Execution Exploit

No description provided by source. ?php ---dragonfly9.0.6.1inclxpl.php 20.15 07/02/2006 CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion - Sun-Tzu Drangonfly killing - coded by rgod site: http://rgod.altervista.org - this works regardless of magicquotesgpc...

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution

this works regardless of magicquotesgpc settings Sun-Tzu: "Thus it may be known that the leader of armies is the arbiter of the people's fate, the man on whom it depends whether the nation shall be in peace or in peril." / a short explaination: install.php is not deleted after dragonfly...

rt-sa-2005-15.txt

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

CVE-2005-4351

CVE-2005-4351 – Summary (concrete details from connected docs): The vulnerability affects BSD Securelevels implementations in FreeBSD (up to 6.0-STABLE and 7.0-CURRENT), OpenBSD (up to 3.8), DragonFly (up to 1.2), and Linux (up to 2.6.15). The root cause is that, while securelevels protect files ...

CVE-2005-4351

The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users to bypass immutable settings for files by mounting another filesystem that masks the immutable files while the system is running...

[Full-disclosure] BSD Securelevels: Circumventing protection of files flagged immutable

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

CVE-2005-4351

The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users to bypass immutable settings for files by mounting another filesystem that masks the immutable files while the system is running...

Dragonfly Shopping Cart Multiple vulnerabilities

Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Get Dcrab's Services to audit your Web servers, scripts, networks, etc or even code them. Learn more at http://www.dbtech.org Severity: High Title: Dragonfly Shopping Cart Multiple vulnerabilities Date:...

CVE-2005-2221

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the 1 key parameter to dcCategoriesview.asp, 2 dcproductslistClearance.asp, 3 PID parameter to ratings.asp, 4 dcProductsview.asp, 5 start, ...