CVE-2006-2877: Undefined Security Weakness

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the includeprefix parameter in 1 inc/dbase.php, 2 inc/config.php, 3 inc/common.php, and 4 inc/function.php. NOTE: it has been reported that the inc directory is...

CVE-2006-2877

CVE-2006-2877 describes a PHP remote file inclusion in Bookmark4U 2.0.0 and earlier. An attacker can cause the application to include arbitrary PHP files via the include_prefix parameter in one of four files: inc/dbase.php, inc/config.php, inc/common.php, or inc/function.php. The advisory notes t...

CVE-2006-2870

Cross-site scripting XSS vulnerability in forumsearch.asp in Intelligent Solutions Inc. ASP Discussion Forum allows remote attackers to inject arbitrary web script or HTML via the search variable...

CVE-2006-2870: Undefined Security Weakness

Cross-site scripting XSS vulnerability in forumsearch.asp in Intelligent Solutions Inc. ASP Discussion Forum allows remote attackers to inject arbitrary web script or HTML via the search variable...

CVE-2006-2860: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 inc/logincheck.inc.php, 2 inc/adminheader.inc.php, 3 inc/global.php, or 4 inc/mainheader.inc.php. NOTE: some of these vectors were also...

CVE-2006-2681: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when registerglobals and magicquotes are enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter to 1 index.php and 2 inc-common.php...

Rapid7 Security Advisory 24

Rapid7 Security Advisory Visit http://www.rapid7.com/ to download NeXpose, SC Magazine Winner of Best Vulnerability Management product. Rapid7 Advisory R7-0024 Caucho Resin Windows Directory Traversal Vulnerability Published: May 16, 2006 Revision: 1.0 http://www.rapid7.com/advisories/R7-0024.htm...

CVE-2006-2344

SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the ubild parameter...

CVE-2006-2344

The CVE-2006-2344 issue affects AliPAGER 1.5, with a SQL injection in inc/elementz.php via the ubild parameter when magic_quotes_gpc is disabled. Root cause is improper input handling enabling arbitrary SQL execution. Impact per available data: partial confidentiality and partial integrity; no av...

CVE-2006-2345

CVE-2006-2345 describes a cross-site scripting (XSS) vulnerability in the AliPAGER 1.5 product, specifically in the file inc/elementz.php. The issue allows remote attackers to inject arbitrary web script or HTML through the ubild parameter. The description notes the provenance is from third‑party...

CVE-2006-2345: Undefined Security Weakness

Cross-site scripting XSS vulnerability in inc/elementz.php in AliPAGER 1.5 allows remote attackers to inject arbitrary web script or HTML via the ubild parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. NOTE: this issue might be...

CVE-2006-2344: Undefined Security Weakness

SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the ubild parameter...

CVE-2006-2329

AngelineCMS 0.6.5 and earlier allow remote attackers to obtain sensitive information via a direct request for 1 adodb-access.inc.php, 2 adodb-ado.inc.php, 3 adodb-adoaccess.inc, 4 adodb-adomssql.inc.php, 5 adodb-borlandibase, 6 adodb-csv.inc.php, 7 adodb-db2.inc.php, 8 adodb-fbsql.inc.php, 9...

neo-Advisory-20.txt

/ --------------------------------------------------------------- Neo Security Team NST® Advisory 20 --------------------------------------------------------------- Program : CuteNews 1.4.1 Homepage: http://www.cutephp.com Vulnerable Versions: CuteNews 1.4.1 & lower ones Risk: Medium! Impact: Cro...

MySQL fails to properly validate COM_TABLE_DUMP packets

Overview MySQL contains a buffer overflow that may allow a remote, authenticated attacker to execute arbitrary code on a vulnerable server. Description MySQL and COMTABLEDUMPMySQL is an open-source database system available for Microsoft Windows, Linux, and other UNIX-based operating systems...

Cute Guestbook Remote XSS Exploit

------------------------------------------------------------------ - Cute Guestbook Remote XSS Exploit - -= http://colander.altervista.org/advisory/CuteGuestbook.txt =- ------------------------------------------------------------------ -= Cute Guestbook =- Omnipresent May 04, 2006 Vunerabilitys:...

CVE-2006-1978

The vulnerability CVE-2006-1978 affects FlexBB 0.5.5 and earlier, due to an SQL injection in inc/start.php. An attacker can manipulate the flexbb_username cookie to execute arbitrary SQL commands on the backend. This is a remote attack with no authentication required, and the impact includes pote...

Solaris 10 (x86) : 122857-04

SunOS 5.10x86: sendmail patch. Date this patch was last updated by Sun : Oct/10/06 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

CVE-2006-1978: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbbusername COOKIE parameter...

CVE-2006-1912: Undefined Security Weakness

MyBB MyBulletinBoard 1.1.0 does not set the constant KILLGLOBAL variable in 1 global.php and 2 inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting XSS or SQL injectio...