CVE-2006-2329: Undefined Security Weakness

AngelineCMS 0.6.5 and earlier allow remote attackers to obtain sensitive information via a direct request for 1 adodb-access.inc.php, 2 adodb-ado.inc.php, 3 adodb-adoaccess.inc, 4 adodb-adomssql.inc.php, 5 adodb-borlandibase, 6 adodb-csv.inc.php, 7 adodb-db2.inc.php, 8 adodb-fbsql.inc.php, 9...

[Full-disclosure] WebCalendar User Account Enumeration Weakness

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. See project homepage for details: http://www.k5n.us/webcalendar.php Description: The problem is that different...

struts LookupDispatchAction XSS

Cross-site scripting XSS vulnerability in 1 LookupDispatchAction and possibly 2 DispatchAction and 3 ActionDispatcher in Apache Software Foundation ASF Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting...

MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities

Secunia reports: MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system. 1 An error within the code that generates an error response to an invalid COMTABLEDUMP packet can be exploited by an...

Sql injection

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

CVE-2006-2047

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

CVE-2006-2047

The CVE-2006-2047 entry affects Application Dynamics Cartweaver ColdFusion versions 2.16.11 and earlier. The vulnerability arises via invalid input parameters in Results.cfm (secondary, PageNum_Results, category, keywords) and Details.cfm (ProdID), which can cause error messages that disclose int...

CVE-2006-2047

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

security flaw

Multiple cross-site scripting XSS vulnerabilities in PHP 4.4.1 and 5.1.1, when displayerrors and htmlerrors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message...

Design/Logic Flaw

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...

CVE-2006-1537: Undefined Security Weakness

Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to 1 includes/index.php, 2 tests/adddurationtest.php, 3 tests/alltests.php, 4 groups.php, 5 nonusers.php, 6 includes/settings.php, 7 includes/init.php, 8 includes/settings.php.orig, 9...

Full path disclosure in Webcalendar 1.1.0-CVS

Full path disclosure in webcalendar Author : Rusydi Hasan M a.k.a : cR45H3R Location : Indonesia, Cilacap Date : March,28th 2006 Version : 1.1.0-CVS --- software description WebCalendar is a PHP application used to maintain a calendar for one or more persons and for a variety of purposes. ---...

Vavoom 1.19.1 - Multiple Vulnerabilities/Denial of Service

/ by Luigi Auriemma / include include include include include ifdef WIN32 include / Header file used for manage errors in Windows It support socket and errno too this header replace the previous sockerrX.h / include include void stderrvoid char error; switchWSAGetLastError case 10004: error =...

Directory traversal

Directory traversal vulnerability in Baby FTP Server BabyFTP 1.24 allows remote authenticated users to determine existence of files outside the intended document root via unspecified manipulations, which generate different error messages depending on whether a file exists or not...

CVE-2006-1383: Undefined Security Weakness

Directory traversal vulnerability in Baby FTP Server BabyFTP 1.24 allows remote authenticated users to determine existence of files outside the intended document root via unspecified manipulations, which generate different error messages depending on whether a file exists or not...

BomberClone < 0.11.6.2 - Error Messages Remote Buffer Overflow

/ bomberclone include include include include include include include / fork + bind port 31337 - ty izik / char linuxshellcode= "\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02\x89\xe1\xcd\x80" "\x5b\x5d\x52\x66\xbd\x69\x7a\x0f\xcd\x09\xdd\x55\x6a\x10\x51"...

SoftBB 0.1 - mail Blind SQL Injection

SoftBB 0.1 - mail Blind SQL Injection !/usr/bin/env python LOTFREE TEAM 03/2006 http://lotfree.next-touch.com/ http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py Vulnerability info Product : SoftBB Version : 0.1 The field 'mail' in reg.php is used directly in a SQL query : $sql = 'SELECT...

CVE-2006-0820

Cross-site scripting XSS vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages...

CVE-2006-0820

Cross-site scripting XSS vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages...

CVE-2006-0820: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages...