INFINICART - 'login.asp' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/21043/info Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of these vulnerabilities could all...

CVE-2006-5628

CVE-2006-5628 describes a SQL injection vulnerability in UNISOR Content Management System (CMS) in login.asp, exploitable via the (1) user or (2) pass fields, allowing remote execution of arbitrary SQL commands. The vulnerability affects UNISOR CMS as documented by NVD/CVE records; the provided r...

CVE-2006-5628: Undefined Security Weakness

SQL injection vulnerability in login.asp in UNISOR Content Management System CMS allows remote attackers to execute arbitrary SQL commands via the 1 user or 2 pass fields...

CVE-2006-4861

SQL injection vulnerability in loginprocess.asp in Mohammed Mehdi Panjwani Complain Center 1 allows remote attackers to execute arbitrary SQL commands via the 1 TxtUser aka Username and 2 TxtPass aka Password parameters in login.asp...

CVE-2006-4861: Undefined Security Weakness

SQL injection vulnerability in loginprocess.asp in Mohammed Mehdi Panjwani Complain Center 1 allows remote attackers to execute arbitrary SQL commands via the 1 TxtUser aka Username and 2 TxtPass aka Password parameters in login.asp...

CVE-2006-3021

Multiple cross-site scripting XSS vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 n and 2 d parameters in a login.asp and the d parameter in b igallery.asp...

CVE-2006-3021

Multiple cross-site scripting XSS vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 n and 2 d parameters in a login.asp and the d parameter in b igallery.asp...

CVE-2006-3021

CVE-2006-3021 describes multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier. The issueable input vectors are the (1) n and (2) d parameters in login.asp and the d parameter in igallery.asp, allowing remote attackers to inject arbitrary web script or HT...

CVE-2006-3021: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 n and 2 d parameters in a login.asp and the d parameter in b igallery.asp...

Sql injection

SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter to 1 login.asp and 2 main.asp...

Information disclosure

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2354

CVE-2006-2354 affects Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium. NmConsole/Login.asp generates different error messages that enable remote attackers to enumerate valid usernames. Root cause is information-disclosing behavior in login error handling. CVSS 2.0 base sc...

CVE-2006-2354

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2357

Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp...

CVE-2006-2354: Undefined Security Weakness

NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-2357: Undefined Security Weakness

Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp...

CVE-2006-2179: Undefined Security Weakness

Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the 1 SessionID parameter to login.asp or 2 ProductIndex parameter to browse0.htm...

CVE-2006-1156

SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp...

CVE-2006-1155: Undefined Security Weakness

Cross-site scripting XSS vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in 1 login.asp and 2 default.asp...

CVE-2006-1156: Undefined Security Weakness

SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp...