CVE-2005-4166: Undefined Security Weakness

Cross-site scripting XSS vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter...

DuWare DuPortalPro 3.4.3 - Password.asp Cross-Site Scripting

DuWare DuPortalPro 3.4.3 - Password.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/15731/info DuPortalPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this...

CVE-2005-3976

SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...

CVE-2005-3976

SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...

CVE-2005-3976

CVE-2005-3976 describes a SQL injection in DUware products (DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1/3.0, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, DUpaypal 3.1/Pro 3.0) via the iType parameter in type.asp. The underlying issue is that user-supplied input is used to constru...

CVE-2005-3976: Undefined Security Weakness

SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...

[SA17835] DUware Products "iType" SQL Injection Vulnerability

TITLE: DUware Products "iType" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA17835 VERIFY ADVISORY: http://secunia.com/advisories/17835/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: DUware DUnews 1.x http://secunia.com/product/2857/ DUware DUgallery...

DUware Multiple Products type.asp iType Parameter SQL Injection

The remote host is running an ASP application from DUware such as DUamazon, DUarticle, DUclassified, DUdirectory, DUdownload, DUgallery, DUnews or DUpaypal. The installed version of that application does not validate input to the 'iType' parameter of the 'inctype.asp' script before using it in a...

CVE-2004-2199

Cross-site scripting XSS vulnerability in DUware DUclassified 4.0 allows remote attackers to inject arbitrary web script or HTML via the message text...

CVE-2004-2200

Cross-site scripting XSS vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML via via the message text...

CVE-2004-2200

DUforum (DUware) versions 3.0–3.1 are affected by a cross-site scripting (XSS) vulnerability in the message text handling, allowing remote attackers to inject arbitrary web script or HTML. The root cause is improper handling/validation of message text content, leading to script execution in the v...

CVE-2004-2198

The CVE-2004-2198 entry relates to DUware DUclassmate 1.0–1.1, where an attacker can remotely change arbitrary user passwords by tampering with the MM_recordId parameter on the My Account page. The connected data also note related issues in DUware products (e.g., DUclassmate, DUclassified, DUforu...

CVE-2004-2202

Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on the server's underlying database via the 1 catid or 2 subid parameters in adDetail.asp, or 2 the password parameter in the login form...

CVE-2004-2199

CVE-2004-2199 is a cross-site scripting (XSS) vulnerability in DUware DUclassified 4.0. The issue arises from how the application handles messages, allowing an attacker to inject arbitrary web script or HTML via the message text. The vulnerability is remote and could enable script execution in th...

CVE-2004-2201

CVE-2004-2201 describes an SQL injection vulnerability in DUware DUforum 3.0–3.1. The issue allows remote attackers to execute arbitrary SQL commands by providing crafted input via the FOR_ID parameter in messages.asp, the MSG_ID parameter in messageDetail.asp, or the password parameter on the lo...

CVE-2004-2202

CVE-2004-2202 affects DUware DUclassified 4.0–4.2. The vulnerability arises from SQL injection in adDetail.asp via (1) cat_id or (2) sub_id parameters, and in the login form via the password parameter, enabling remote attackers to bypass authentication and execute commands on the server’s underly...

CVE-2004-2198

account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MMrecordId parameter on the "My Account" page...

CVE-2004-2201: Undefined Security Weakness

SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FORID parameter in messages.asp, 2 MSGID parameter in messageDetail.asp, or 3 password parameter in the login form...

CVE-2004-2199: Undefined Security Weakness

Cross-site scripting XSS vulnerability in DUware DUclassified 4.0 allows remote attackers to inject arbitrary web script or HTML via the message text...

CVE-2004-2198: Undefined Security Weakness

account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MMrecordId parameter on the "My Account" page...