CVE-2010-1076

Cross-site scripting XSS vulnerability in index.php in Entry Level CMS EL CMS allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are...

CVE-2010-1076: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Entry Level CMS EL CMS allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are...

BBSxp 2 0 0 8 (Build: 8.0.4) Sql injection vulnerability-vulnerability warning-the black bar safety net

File:MoveThread. asp MoveThread. asp line 2-2 of 4 % if CookieUserName =empty then error"you have nota href=""javascript:BBSXPModal. Open 'Login. asp',3 8 0,1 7 0;""login/a" 'save the cookie log can be ThreadID=Request"ThreadID" ' Sql Injection Vulnerability If Not IsNumericThreadID then...

CVE-2010-0376

Cross-site scripting XSS vulnerability in productlist.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attackers to inject arbitrary web script or HTML via the cat parameter. NOTE: this issue is reportedly resultant from a forced SQL error message that occurs from exploitation ...

CVE-2010-0376

CVE-2010-0376 is an XSS vulnerability in JCE-Tech PHP Calendars, specifically in product_list.php where the cat parameter can be exploited to inject arbitrary HTML/Script. The issue is described as arising from a forced SQL error message related to CVE-2010-0375. Connected sources confirm the vul...

Apache Tomcat Error Message Reporting 跨站脚本攻击漏洞

No description provided by source...

Code injection

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...

conn. asp storm library law principles and applications-vulnerability warning-the black bar safety net

Today learn conn. asp storm database,this method is a very old method,it is through direct access to the database connection file conn. asp enables the server to produce the error,by returning the error information to storm out of the database the absolute path,here in conn. asp is the database...

CVE-2009-4322

extras/ipntestreturn.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...

Information disclosure

PowerPhlogger 2.2.5 allows remote attackers to obtain sensitive information via a direct request to 1 edCss.inc.php, 2 foot.inc.php, 3 getcsscolors.inc.php, 4 head.inc.php, 5 headstuff.inc.php, 6 loglist.inc.php, and 7 pphloggersend.inc.php in include/, which reveals the installation path in an...

CVE-2009-3727

Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error message...

CVE-2009-3838: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Pegasus Mail PMail 4.41 and possibly 4.51 allows remote POP3 servers to cause a denial of service application crash or possibly execute arbitrary code via a long error message...

CVE-2009-3837: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 servers to execute arbitrary code via a long error message...

Windows Media Player Plugin: Local File Detection Vulnerability

No description provided by source. Windows Media Player Plugin: Local File Detection Vulnerability A design flaw in Windows Media Player 11 allows a remote attacker to determine the \ presence of local files programs, documents, etc.. I sent an e-mail to Microsoft \ nearly a year ago but they nev...

Windows Media Player Plugin: Local File Detection Vulnerability

Windows Media Player Plugin: Local File Detection Vulnerability A design flaw in Windows Media Player 11 allows a remote attacker to determine the presence of local files programs, documents, etc.. I sent an e-mail to Microsoft nearly a year ago but they never responded… Windows Media Player...

Mura CMS <= 5.1 xss

Exploit for unknown platform in category web applications =================== Mura CMS = 5.1 xss =================== Objective: Mura CMS = 5.1 Type: Disclosure of ways Threat: Medium Date Discovered: 22.09.2009 Date of notification Developer: 22.09.2009 Released corrections: Author: Vladimir...

CVE-2009-3815

RunCMS 2M1, when running with certain errorreporting levels, allows remote attackers to obtain sensitive information via 1 the op parameter to modules/contact/index.php or 2 uid parameter to userinfo.php, which leaks the installation path in an error message when these parameters are used in a ca...

CVE-2009-3802

Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname "%%%" to admin/index.php, which reveals the installation path and other information in an error message...

Information disclosure

phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to 1 footer.php, 2 header.php, 3 the show action in advancedsearch.php, and 4 choicelist.php, which reveals the installation path in an error message...

CVE-2009-3030: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an error message in a response, related to an "HTML Injection issue."...