CVE-2006-4546

Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS.List parameter...

CVE-2006-4547

Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' single quote character in the name, which reveals the details of the underlying SQL query, possibly because of a forced SQL error or SQL injection...

CVE-2006-4546

CVE-2006-4546 affects Lyris ListManager 8.95. The vulnerability allows remote authenticated users who have administrative privileges for at least one list to add new administrators to any list by modifying the MEMBERS_.List_ parameter. The underlying cause is parameter manipulation that bypasses ...

Lyris ListManager privilege escalation

Administrator of any mail list can assign any user as an addministrator of any different mail list...

[Full-disclosure] Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list

Advisory: Lyris ListManager 8.95: Add arbitrary administrator to arbitrary list Release Date: 2006-08-30 Application: Lyris ListManager 8.95 Risk: Depends upon your use and business context Vendor site: http://www.lyris.com/ Overview of Product: "Lyris ListManager is the world's most popular...

Lyris ListManager MSDE Weak sa Password

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris. The version of ListManager on the remote host was installed using Microsoft SQL Server Desktop Engine MSDE for its database backend along with a weak password for the 'sa'...

lyris_attachment_mssql.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

lyris-listmanager.txt

Title: Lyris ListManager Multiple Flaws Release Date: December 8, 2005 Patch Date: Unknown v8.9b resolves most issues Reported Date: June 21, 2005 Vendor: Lyris Systems Affected: Lyris ListManager v5.0-8.8a most flaws Summary: The Lyris ListManager software is vulnerable to numerous SQL injection...

CVE-2005-4148

Lyris ListManager 8.5, and possibly other versions before 8.8, includes sensitive information in the env hidden variable, which allows remote attackers to obtain information such as the installation path by requesting a non-existent page and reading the env variable from the resulting error messa...

CVE-2005-4145

The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space "lyris" and up to 5 digits, possibly from the process ID, which allows remote attackers to gain access via a brute force attack...

CVE-2005-4149

Lyris ListManager 8.8 through 8.9b allows remote attackers to obtain sensitive information by causing errors in TML scripts, such as via direct requests, which leaks the installation path, SQL queries, or product code in diagnostic messages...

CVE-2005-4147

The TCLHTTPd service in Lyris ListManager before 8.9b allows remote attackers to obtain source code for arbitrary .tml TCL files via 1 a request with a trailing null byte %00, which might also require 2 an authentication bypass step that involves a username with a trailing "@" characters...

CVE-2005-4143

SQL injection vulnerability in Lyris ListManager 5.0 through 8.9a allows remote attackers to execute arbitrary SQL commands via SQL code after a numeric argument to a /read/attachment URL...

CVE-2005-4146

Lyris ListManager before 8.9b allows remote attackers to obtain sensitive information via a request to the TCLHTTPd status module, which provides sensitive server configuration information...

CVE-2005-4142

The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR %0A%0D sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a...

CVE-2005-4144

Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as 1 newlines and 2 0xFF ASCII 255 characters, which are interpreted as whitespace...

CVE-2005-4145

Lyris ListManager MSDE (MSDE-backed ListManager 5.0–8.9b) exposes a weak sa password: “lyris” followed by up to five digits (likely the installer’s process ID). This enables remote brute-force access to the SA account in the SQL Server backend, allowing database administrator access. Public sourc...

CVE-2005-4149

Lyris ListManager 8.8 through 8.9b allows remote attackers to obtain sensitive information by causing errors in TML scripts, such as via direct requests, which leaks the installation path, SQL queries, or product code in diagnostic messages...

CVE-2005-4146

Lyris ListManager before 8.9b allows remote attackers to obtain sensitive information via a request to the TCLHTTPd status module, which provides sensitive server configuration information...

CVE-2005-4148

CVE-2005-4148 affects Lyris ListManager 8.5 and possibly earlier than 8.8. The flaw is an information disclosure where sensitive data is exposed via an env hidden variable; a remote attacker can cause the server to return a non-existent page and read the env variable from the error page, revealin...