128 matches found
[Aria-Security Team] DuWare DuNews SQL Injection Vuln
Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory: http://www.aria-security.com/forum/showthread.php?t=61 ----------------------------------------------------------- Software: DuNews Method: SQL Injection Vendor: http://www.duware.co...
DUdownload 1.0/1.1 - 'detail.asp' Multiple SQL Injections
source: https://www.securityfocus.com/bid/21405/info Multiple DuWare products are prone to multiple SQL-injection vulnerabilities because they fail to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise the application,...
CVE-2006-4487
DUware DUpoll 3.0 and 3.1 stores private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords...
CVE-2006-4487
CVE-2006-4487 affects DUware DUpoll 3.0 and 3.1, where a file under the web document root named _private/Dupoll.mdb is stored with insufficient access control. This allows remote attackers to access sensitive information, specifically user credentials such as usernames and passwords. The provided...
CVE-2006-4487
DUware DUpoll 3.0 and 3.1 stores private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords...
CVE-2006-2428
add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be bypassed. NOTE: some of these details are obtained from third party information, since the raw sour...
CVE-2006-2428
The CVE-2006-2428 issue affects DUbanner 3.1 (DUware) via the add.asp endpoint, where uploading files with arbitrary extensions (e.g., ASP) can lead to remote code execution. Root cause cited is weak server-side validation/enforcement that can be bypassed by clients. Impact is remote code executi...
CVE-2006-2428
add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be bypassed. NOTE: some of these details are obtained from third party information, since the raw sour...
[SA20102] DUbanner Insecure File Upload Vulnerability
TITLE: DUbanner Insecure File Upload Vulnerability SECUNIA ADVISORY ID: SA20102 VERIFY ADVISORY: http://secunia.com/advisories/20102/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: DUware DUbanner 3.x http://secunia.com/product/2848/ DESCRIPTION: Dj ReMix has...
CVE-2005-4166
Cross-site scripting XSS vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter...
CVE-2005-4166
The CVE-2005-4166 entry documents a Cross-site Scripting (XSS) vulnerability in DUWare DUportal Pro 3.4.3, exploitable via the result parameter in password.asp. The affected component is password.asp within DUportal Pro 3.4.3; the root cause is input handling allowing script/HTML injection. The p...
CVE-2005-4166
Cross-site scripting XSS vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter...
DuWare DuPortalPro 3.4.3 - Password.asp Cross-Site Scripting
DuWare DuPortalPro 3.4.3 - Password.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/15731/info DuPortalPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this...
CVE-2005-3976
SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...
CVE-2005-3976
SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...
CVE-2005-3976
CVE-2005-3976 describes a SQL injection in DUware products (DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1/3.0, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, DUpaypal 3.1/Pro 3.0) via the iType parameter in type.asp. The underlying issue is that user-supplied input is used to constru...
[SA17835] DUware Products "iType" SQL Injection Vulnerability
TITLE: DUware Products "iType" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA17835 VERIFY ADVISORY: http://secunia.com/advisories/17835/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: DUware DUnews 1.x http://secunia.com/product/2857/ DUware DUgallery...
DUware Multiple Products type.asp iType Parameter SQL Injection
The remote host is running an ASP application from DUware such as DUamazon, DUarticle, DUclassified, DUdirectory, DUdownload, DUgallery, DUnews or DUpaypal. The installed version of that application does not validate input to the 'iType' parameter of the 'inctype.asp' script before using it in a...