EUVD-2006-2029

Malware in sbrugna...

CVE-2006-2029: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 tid parameter in a preview.php; the 2 cid, 3 pid, and 4 eid parameters in b archive.php; and the 5 pid parameter in c comments.php...

CVE-2006-2028: Undefined Security Weakness

Cross-site scripting XSS vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the imagedir parameter. NOTE: this issue might be resultant from directory traversal...

CVE-2006-2029

CVE-2006-2029 affects Jeremy Ashcraft’s Simplog, version 0.9.3 and earlier. The issue comprises multiple SQL injection vulnerabilities that let remote attackers execute arbitrary SQL commands via the following parameters: (a) tid in preview.php; (b) cid, pid, eid in archive.php; and (c) pid in co...

CVE-2006-2028

The CVE-2006-2028 entry concerns a Cross-site Scripting (XSS) vulnerability in imagelist.php of Jeremy Ashcraft Simpleg 0.9.3 and earlier. The issue allows remote attackers to inject arbitrary script/HTML via the imagedir parameter, with note that it may stem from directory traversal. Affected so...

CVE-2006-1779

Cross-site scripting XSS vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter...

CVE-2006-1778

CVE-2006-1778 affects Simplog

CVE-2006-1779

CVE-2006-1779 describes a Cross-site scripting (XSS) vulnerability in Simplog 0.9.2 and earlier, specifically in login.php where the btag parameter can be used to inject arbitrary script/HTML. Affected product: Simplog (Jeremy Ashcraft) <= 0.9.2. Attack vector from the description is a remote ...

CVE-2006-1777: Undefined Security Weakness

Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache errorlog file, which...

CVE-2006-1778: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 blogid parameter in a index.php and b archive.php, the 2 m and 3 y parameters in archive.php, and the 4 sql parameter in c server.php...

CVE-2006-1779: Undefined Security Weakness

Cross-site scripting XSS vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter...

CVE-2006-1776: Undefined Security Weakness

PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the s parameter...