CuteNews 1.4.6 - result Cross-Site Scripting

CuteNews 1.4.6 - result Cross-Site Scripting source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note...

CuteNews 1.4.6 - from_date_day Full Path Disclosure

CuteNews 1.4.6 - fromdateday Full Path Disclosure source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues...

CuteNews 1.4.6 editnews Module - doeditnews Action Admin Moderation Bypass

source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...

CuteNews 1.4.6 - 'from_date_day' Full Path Disclosure

source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...

CVE-2009-3865

The launch method in the Deployment Toolkit plugin in Java Runtime Environment JRE in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752...

Sql injection

Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to main.php and 2 gameid parameter to game.php...

CVE-2009-3500

CVE-2009-3500 affects BPowerHouse BPGames 1.0. It describes multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the cat_id parameter to main.php and the game_id parameter to game.php, indicating improper input handling in these endpoints. The r...

CVE-2009-3148

Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 calendar.php, 2 news.php, and 3 links.php; and the 4 assignmentid parameter to assignments.php...

CVE-2009-2888

SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter...

XEmacs多个整数溢出漏洞

Bugraq ID: 35473 XEmacs是一款强大的文本编辑器。 XEmacs存在多个漏洞，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 -glyphs-eimage.c包含的"tiffinstantiate"函数存在整数溢出错误，构建特殊的TIFF文件可触发。 -glyphs-eimage.c包含的"pnginstantiate"函数存在整数溢出错误，构建特殊的PNG文件可触发。 -glyphs-eimage.c包含的"jpeginstantiate"函数存在整数溢出错误，构建特殊的JPEG文件可触发。 XEmacs 21.4.22 目前没有解决方案提供：...

Command injection

Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote attackers to execute arbitrary commands via unknown attack vectors, aka "command injection vulnerability."...

CVE-2009-1656

Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote attackers to execute arbitrary commands via unknown attack vectors, aka "command injection vulnerability."...

Sql injection

Multiple SQL injection vulnerabilities in the inserttopastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal Pastebin before 2.80 allow remote attackers to execute arbitrary SQL commands via the 1 subject, 2 language, and 3 nickname parameters to...

Sql injection

Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via 1 the user parameter aka UserName field or 2 the pass parameter aka Pass field to a admin/admin.asp or b the default URI under admin/. NOTE: some of these detai...

Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH buffer overflow

Added: 01/28/2009 CVE: CVE-2008-5444 BID: 33177 OSVDB: 51340 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A buffer overflow vulnerability in Oracle Secure Backup when handling the NDMP protocol allows remote attackers to execute...

CVE-2008-5749

Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. NOTE: a third party disputes this issue, stating that Chrome "will ask for user permission" and "cannot launch...

CVE-2008-5750

Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI...

verlihub -- insecure temporary file usage and arbitrary command execution

securityfocus reports: An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files,...

CVE-2008-4457

SQL injection vulnerability in inc/incstatistics.php in MemHT Portal 3.9.0 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via a statsres cookie to index.php...

CVE-2008-4247

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks and execute arbitrary FTP commands via a long ftp:// URI...