278 matches found
Unfixed XSS vulnerability at www.icefan.ca
Security researcher Persian Fox, has submitted on 09/10/2008 a cross-site-scripting XSS vulnerability affecting www.icefan.ca, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/09/2009. It is currently...
Sql injection
Multiple SQL injection vulnerabilities in admin/login.asp in E. Z. Poll 2 allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-3590: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in admin/login.asp in E. Z. Poll 2 allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-3082
Cross-site scripting XSS vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter...
CVE-2008-3082: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter...
CVE-2008-3082
Cross-site scripting XSS vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter...
Unfixed XSS vulnerability at proposalcentral.altum.com
Security researcher Reelix, has submitted on 07/08/2008 a cross-site-scripting XSS vulnerability affecting proposalcentral.altum.com, which at the time of submission ranked 1129203 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/08/2008. It ...
CVE-2008-2861
Multiple cross-site scripting XSS vulnerabilities in eLineStudio Site Composer ESC 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topic and 2 button parameters to ansFAQ.asp and the 3 id and 4 txtEmail parameters to login.asp...
CVE-2008-2861: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in eLineStudio Site Composer ESC 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topic and 2 button parameters to ansFAQ.asp and the 3 id and 4 txtEmail parameters to login.asp...
CVE-2008-2682: Undefined Security Weakness
RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pages via certain modified cookies, probably including 1 cUserRole, 2 cUserName, and 3 cUserID...
CVE-2008-1548: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Aeries Browser Interface ABI 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the 1 UserName parameter to loginproc.asp and the 2 usr parameter to Login.asp...
aeries-sqlxss.txt
Discovered By : Arsalan Emamjomehkashan aeries browser interfaceABI 3.8.3.14 Remote SQL Injection Website:http://aeries.com/ SQL injection: GradebookOptions.asp?GrdBk=SQL loginproc.asp If you post variable "SchlCode" XSS: UserName variable on loginproc.asp and usr on Login.asp...
Nukedit utilities/login.asp email Parameter SQL Injection
The remote host is running Nukedit, a content management system written in ASP. The version of Nukedit installed on the remote host fails to sanitize user input to the 'email' parameter of the 'utilities/login.asp' script before using it in a database query. An unauthenticated attacker may be abl...
CVE-2008-0543
CVE-2008-0543 describes multiple SQL injection vulnerabilities in Pre Dynamic Institution . Remote attackers can execute arbitrary SQL commands through the (1) sloginid and (2) spass parameters to login.asp and siteadmin/login.asp . The reports do not provide explicit root cause details or confir...
CVE-2008-0543: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Pre Dynamic Institution allow remote attackers to execute arbitrary SQL commands via the 1 sloginid and 2 spass parameters to a login.asp and b siteadmin/login.asp. NOTE: some of these details are obtained from third party information...
CVE-2008-0487
CVE-2008-0487 involves multiple SQL injection vulnerabilities in login.asp of ASPired2Protect. The vulnerability allows remote attackers to append or modify SQL commands via the (1) username and (2) password parameters, potentially exposing or altering data. The primary affected component is the ...
CVE-2008-0487: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in login.asp in ASPired2Protect allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters. NOTE: some of these details are obtained from third party information...
CVE-2008-0208: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in login.asp in Snitz Forums 2000 3.4.05 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter...
CVE-2008-0209: Improper Input Validation
Open redirect vulnerability in Forums/login.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to redirect users to arbitrary web sites via a URL in the target parameter...