crfdb-disclose.txt

Title : Capital Request Forms Db Username and Password Vulnerabilities Author : Gokhan Contact : [email protected] Dork : inurl:commondb.inc Script : http://selfemployment.douglas.bc.ca/caprequest/ ExpLoit : http://site/path/inc/commondb.inc ; Code : commondb.inc...

CVE-2007-0880

CVE-2007-0880 describes an access-control flaw where the application stores sensitive information under the web root, enabling remote attackers to retrieve database credentials by directly requesting inc/common_db.inc. The document set confirms the affected vector as an unauthenticated direct req...

Capital Request Forms Db Username and Password Vulnerabilities

Title : Capital Request Forms Db Username and Password Vulnerabilities Author : Gokhan Contact : [email protected] Dork : inurl:commondb.inc Script : http://selfemployment.douglas.bc.ca/caprequest/ ExpLoit : http://site/path/inc/commondb.inc ; Code : commondb.inc...

USN-398-4: Firefox regression

USN-398-2 fixed vulnerabilities in Firefox 1.5. However, when auto-filling saved-password login forms without a username field, Firefox would crash. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Various flaws have been reported that allow an attacke...

security flaw

Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the 1 FDF, 2 XML, or 3 XFDF AJAX request parameters...

Adobe Acrobat Reader Plugin - Multiple Vulnerabilities

Adobe Acrobat Reader Plugin - Multiple Vulnerabilities Original Advisory: http://www.wisec.it/vulns.php?page=9 Original Discovery and Research: Stefano Di Paola Contribution: Giorgio Fedon IE Dos, UXSS Analysis Elia Florio Poc and Code Execution analysis Status: Vendor Informed on 15 October 2006...

FreeBSD : drupal -- cross site request forgeries (937d5911-5f16-11db-ae08-0008743bf21a)

The Drupal Team reports : Visiting a specially crafted page, anywhere on the web, may allow that page to post forms to a Drupal site in the context of the visitor's session. To illustrate; suppose one has an active user 1 session, the most powerful administrator account for a site, to a Drupal si...

CVE-2006-5358

Unspecified vulnerability in Oracle Forms component in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 has unknown impact and remote attack vectors, aka Vuln FORM01...

CVE-2006-5365

Unspecified vulnerability in Oracle Forms in Oracle Application Server 9.0.4.3 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10CU2, has unknown impact and remote attack vectors, aka Vuln FORM02...

CVE-2006-5358

Unspecified vulnerability in Oracle Forms component in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 has unknown impact and remote attack vectors, aka Vuln FORM01...

CVE-2006-5360

Unspecified vulnerability in Oracle Forms component in Oracle Application Server 9.0.4.2 has unknown impact and remote attack vectors, aka Vuln FORM03...

CVE-2006-5365

Technical details for CVE-2006-5365 are not publicly provided in the supplied documents; no affected product versions, root cause, or remediation are specified. Monitor for updates from official advisories.

CVE-2006-5358

Technical details of CVE-2006-5358 are not publicly available in the provided documents. Monitor for updates from Oracle advisories or security bulletins; current sources confirm an unspecified vulnerability in Oracle Forms without specifics.

CVE-2006-5360

Technical details for CVE-2006-5360 are not publicly available in the provided documents. Monitor for updates; no further specifics (impact, vectors, or remediation) can be stated from these sources.

CVE-2006-5365

Unspecified vulnerability in Oracle Forms in Oracle Application Server 9.0.4.3 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10CU2, has unknown impact and remote attack vectors, aka Vuln FORM02...

ASP.NET crossite scripting

Crossite scripting with AutoPostBack forms...

GeoClassifieds Enterprise 2.0.5.x - index.php Multiple Cross-Site Scripting Vulnerabilities

GeoClassifieds Enterprise 2.0.5.x - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/19196/info GeoClassifieds Enterprise is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attack...

Low: Red Hat Bug Fix Advisory: conga bug fix update

Updated conga packages that provide critical bug fixes are now available. The Conga package is a web-based administration tool for remote cluster and storage management. This erratum applies the following bug fixes: - The borrowed Zope packages used by Conga have been patched to eliminate a...

CVE-2006-3398

The CVE-2006-3398 entry involves Taskjitsu prior to 2.0.1, where password hashes are embedded in hidden fields of the change password forms. This allows remote attackers to obtain sensitive information from the Category Editor and the User Information editor. The issue is tied to versions before ...

MobeSpace v2.0 - XSS

MobeSpace v2.0 Homepage: http://mobescripts.com/ Effected files: index.php The input forms of: - Profile - Comments - Uploading a file to your locker - Posting in your blog - Creating a caption for your pic - Sending PM's The input boxes of the above do not sanatize user input before generating i...