CVE-2006-5219: Undefined Security Weakness

SQL injection vulnerability in blog/index.php in the blog module in Moodle 1.6.2 allows remote attackers to execute arbitrary SQL commands via a double-encoded tag parameter...

CVE-2006-5152

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032...

CVE-2006-5152: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032...

CVE-2006-5037

MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sqcontentsrc parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting XSS attacks. NOTE: the researcher reports that "The vendor...

CVE-2006-5037

MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sqcontentsrc parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting XSS attacks. NOTE: the researcher reports that "The vendor...

CVE-2006-5037

CVE-2006-5037 affects MySource Matrix versions after 3.8. The issue allows remote attackers to use the application as an HTTP proxy via a MIME-encoded URL in the sq_content_src parameter, enabling access to arbitrary sites using the server’s IP and enabling cross-site scripting (XSS). The PT-2006...

CVE-2006-5050

CVE-2006-5050 affects BusyBox by its httpd component, enabling directory traversal through URL-encoded "%2e%2e/" sequences in the URI. The underlying issue is a path traversal vulnerability that could allow remote attackers to read arbitrary files. According to the NVD entry, this is a network-ac...

CVE-2006-5050: Undefined Security Weakness

Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI...

PT-2006-5778 · Matrix · Matrix

Name of the Vulnerable Software and Affected Versions: Matrix versions after 3.8 Description: The issue allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq content src parameter. This can be used to access arbitrary sites with the server's IP...

Busy box httpd file traversal vulenrability

a file traversal attack is possible in busybox's http daemon when you send a url encoded slash like this http://attacked-host//2e2e/2e2e/2e2e/2e2e/2e2e/etc/passwd I have tested with busy box 1.01 and I dont know if other versions are vulenrable...

CVE-2006-0032: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose...

CVE-2006-4676

TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file...

CVE-2006-4676

TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file...

CVE-2006-4676: Undefined Security Weakness

TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file...

CVE-2006-4654

Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service crash or "compromise the server" via encoded format string specifiers in the query string...

CVE-2006-4449: Undefined Security Weakness

Cross-site scripting XSS vulnerability in attachment.php in MyBulletinBoard MyBB 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer...

altnwebadmin.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TTG0601 - Alt-N WebAdmin Multiple Vulnerabilities RELEASE DATE: August 21st, 2006 VENDOR: Alt-N Technologies http://www.altn.com VULNERABLE: Tested on Alt-N WebAdmin v3.2.3/3.2.4 running with MDaemon v9.0.5, earlier versions are suspected vulnerable a...

blsXSS.txt

----------------------------------------------------------------------------------------- Found by: PrOtOn & digi7al64 Date: May 20th 2006 Critical Level: High Type: Multiple Cross Site Scripting XSS vunerabilities...

CVE-2006-4317

CVE-2006-4317 affects WoltLab Burning Board (WBB) 2.3.5 in attachment.php. It is a cross-site scripting (XSS) vulnerability where a GIF image containing URL-encoded Javascript can be used to inject arbitrary script, with the impact described as partial confidentiality/integrity/availability in th...

CVE-2006-4317

Cross-site scripting XSS vulnerability in attachment.php in WoltLab Burning Board WBB 2.3.5 allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript...