magiciso 5.0 build 0166 - Directory Traversal

magiciso 5.0 build 0166 - Directory Traversal source: https://www.securityfocus.com/bid/17725/info Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. A successful attack can allow the attacker to...

Farsinews 2.5.3 - Multiple Cross-Site Scripting Vulnerabilities

Farsinews 2.5.3 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/17701/info FarsiNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An attacker may...

Fenice OMS 1.10 (long get request) Remote Buffer Overflow Exploit

No description provided by source. / IHS Iran Homeland Security public source code Fenice - Open Media Streaming Server remote BOF exploit author : c0d3r "kaveh razavi" [email protected] package : fenice-1.10.tar.gz and prolly prior versions workaround : update after patch release advisory :...

Instant Photo Gallery 1.0 - 'portfolio_photo_popup.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17696/info Instant Photo Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

PhotoKorn 1.531.54 - index.php Multiple SQL Injections

PhotoKorn 1.531.54 - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/17683/info Photokorn is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit cou...

SAXoPRESS pbcs.dll url Parameter Traversal Arbitrary File Access

The remote host is running SAXoPRESS or Publicus, web content management systems commonly used by newspapers. The installation of SAXoPRESS / Publicus on the remote host fails to validate user input to the 'url' parameter of the 'apps/pbcs.dll' script. An attacker can exploit this issue to access...

Opera < 8.54 Multiple Vulnerabilities

The remote host is using Opera, an alternative web browser. The version of Opera installed on the remote host contains a buffer overflow that can be triggered by a long value within a stylesheet attribute. Successful exploitation can lead to a browser crash and possibly allow for the execution of...

Papoo 2.1.x - 'print.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17530/info Papoo is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context o...

AR-Blog 5.2 - print.php Cross-Site Scripting

AR-Blog 5.2 - print.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17522/info The ar-blog application is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code...

Dokeos 1.x - 'viewtopic.php' SQL Injection

source: https://www.securityfocus.com/bid/17463/info Dokeos is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Shadowed Portal 5.7 - 'Load.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17430/info Shadowed Portal is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the...

ShopWeezle 2.0 - memo.php?itemID SQL Injection

ShopWeezle 2.0 - memo.php?itemID SQL Injection source: https://www.securityfocus.com/bid/17441/info ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...

CVE-2004-2655

The CVE-2004-2655 issue affects XScreenSaver (xscreensaver) components used with rdesktop 1.3.1 and Fedora-era setups. The root cause is a keyboard focus flaw: XScreenSaver prompt for password did not reliably ensure keyboard focus, potentially leaking the user’s password to the focused program w...

CVE-2004-2655

rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen...

MAXDEV CMS 1.0.72/1.0.73 - 'PNuserapi.php' SQL Injection

source: https://www.securityfocus.com/bid/17399/info MAXDEV CMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Bugzero 4.3.1 - query.jsp?msg Cross-Site Scripting

Bugzero 4.3.1 - query.jsp?msg Cross-Site Scripting source: https://www.securityfocus.com/bid/17351/info Bugzero is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these...

HP Color LaserJet 2500/4600 Toolbox - Directory Traversal

source: https://www.securityfocus.com/bid/17367/info The HP Color LaserJet 2500/4600 Toolbox is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrar...

SoftBiz Image Gallery - 'images.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/17339/info Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacke...

Zdaemon 1.8.1 - Multiple Vulnerabilities

Zdaemon 1.8.1 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/17340/info ZDaemon is prone to multiple remote vulnerabilities. A buffer overflow vulnerability exists in the 'isclientwadok' function. A remote denial of service condition also affects the server. ZDaemon 1.08.01...

Blank'N'Berg 0.2 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/17346/info Blank'N'Berg is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser...