CVE-2006-1152

PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1152

PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1152

CVE-2006-1152 affects M-Phorum 0.2. The issue is a PHP remote file inclusion in index.php where an attacker can include arbitrary files through the go parameter. According to the NVD entry, the vulnerability has a CVSSv2 base score of 5.0 (Medium) with network attack vector, low complexity, no au...

CVE-2006-1151

CVE-2006-1151 is a cross-site scripting vulnerability in M-Phorum 0.2, exploitable via the go parameter in index.php. The NVD entry notes an injected script/HTML and a CVSS2 base score of 5.0 (MEDIUM) with network access, no authentication, and partial integrity impact (I:P). Affected component: ...

CVE-2006-1151

Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter...

M-Phorum Cross Site Scripting

------------------------------------------------------------------------------------- M-Phorum Cross Site Scripting Site:http://m-phorum.sourceforge.net/site/ Credit : CodeXpLoder'tq webpage:www.biyosecurity.com Mail :[email protected]...

EV0082.txt

New eVuln Advisory: Leif M. Wright's Blog Multiple Vulnerabilities http://evuln.com/vulns/82/summary.html --------------------Summary---------------- eVuln ID: EV0082 CVE: CVE-2006-0843 CVE-2006-0844 CVE-2006-0845 CVE-2006 Software: Leif M. Wright's Blog Sowtware's Web Site:...

[eVuln] Leif M. Wright's Blog Multiple Vulnerabilities

New eVuln Advisory: Leif M. Wright's Blog Multiple Vulnerabilities http://evuln.com/vulns/82/summary.html --------------------Summary---------------- eVuln ID: EV0082 CVE: CVE-2006-0843 CVE-2006-0844 CVE-2006-0845 CVE-2006 Software: Leif M. Wright's Blog Sowtware's Web Site:...

CVE-2006-0917

Melange Chat Server aka M-Chat, when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive...

CVE-2006-0917

Technical details about CVE-2006-0917 are not provided in the connected documents; available sources describe cookies disclosure via a vulnerable link but do not specify affected versions, root cause, or remediation in these inputs.

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the 1 Referer and 2 User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly usin...

CVE-2006-0843

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...

Improper access control

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...

CVE-2006-0844

Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie...

CVE-2006-0844

Leif M. Wright's Blog 3.5 is affected by an authentication bypass through cookie handling. The vulnerability arises because the blog.cgi script does not perform a password comparison when identifying an administrator via the blogAdmin cookie, enabling remote attackers to bypass login authenticati...

CVE-2006-0845

CVE-2006-0845 affects Leif M. Wright's Blog 3.5. The vulnerability arises when an administrator can configure the sendmail path to a malicious pathname, allowing remote authenticated users with admin privileges to execute arbitrary shell commands. The EVULN/SECURITYVULNS records indicate a shell ...

CVE-2006-0844

Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie...

CVE-2006-0846

CVE-2006-0846 affects Leif M. Wright’s Blog 3.5. Multiple XSS vulnerabilities allow remote attackers to inject arbitrary scripts via the Referer and User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the Log page (ViewCommentsLog). Root cause: l...