3891 matches found
Magic Winmail Server 2.3 USER POP3 - Command Format String
Magic Winmail Server 2.3 USER POP3 - Command Format String // source: https://www.securityfocus.com/bid/7667/info A format string vulnerability has been reported for Magic Winmail Server when processing the USER POP3 command. An attacker may exploit this vulnerability by connecting to the...
Magic Winmail Server 2.3 USER POP3 - Command Format String
// source: https://www.securityfocus.com/bid/7667/info A format string vulnerability has been reported for Magic Winmail Server when processing the USER POP3 command. An attacker may exploit this vulnerability by connecting to the vulnerable mail server and issuing the USER command with malicious...
Magic Winmail Server v.2.*: format string
-----BEGIN PGP SIGNED MESSAGE----- Damage Hacking Group security advisory www.dhgroup.org Product: Magic Winmail Server Auth: AMAX Information Technologies Inc. www.magicwinmail.net Vulnerable versions: v.2. founded in 2.3 Vulnerability: format string...
CVE-2002-1482
SQL injection vulnerability in login.php for phpGB 1.20 and earlier, when magicquotesgpc is not enabled, allows remote attackers to gain administrative privileges via SQL code in the password entry...
CVE-2002-0287
The vulnerability affects Powie PHP Forum versions prior to 1.15. The root cause is that PHP magic_quotes is not explicitly enabled by default, enabling an attacker to bypass authentication and gain administrator privileges via an SQL injection when the PHP server is not configured to use magic q...
phpnuke60.txt
Informations : °°°°°°°°°°°°°° Language : PHP Website : http://www.phpnuke.org Versions : 6.0 & 6.5? Modules : MembersList, YourAccount Problem : SQL Injection PHP Configuration : This will work if magicquotesgpc=OFF. PHP Code/Location : °°°°°°°°°°°°°°°°°°° /modules/MembersList/index.php :...
CVE-2002-1160
The default configuration of the pamxauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su...
CVE-2002-1969
Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service crash via an invalid username during login...
phpGB: mysql injection bug
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following mysql-injection-bug in phpGB: Details - ------- Product: phpGB Affected Version: 1.20 and maybe all versions before Immune Version: 1.40 OS affected: all OS with php Vendor-URL: http://www.walzl.net Vendor-Status:...
Magic Enterprise contains multiple shell scripts that allow arbitrary file overwriting via symlink redirection of temporary file
Overview Some versions of Magic eDeveloper Enterprise Edition contain a symbolic-link vulnerability that allows attackers to overwrite data or execute arbitrary commands. Description Magic eDeveloper is a development environment for large-scale and distributed applications.Magic eDeveloper...
Several problems in CARE 2002
Several problems in CARE 2002 ------------------------------------- What is CARE 2002? CARE 2002 is a free software package for hospitals. It's based on php + mysql. For further information visit http://www.care2x.com/. include + NULL problem Problem description There are several include statemen...
CVE-2002-0536
PHPGroupware 0.9.12 and earlier, when running with the magicquotesgpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack...
CVE-2002-0287
pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default...
Security holes : XMB Magic Lantern forum & DevBB
Hi all : Product 1 : XMB Magic Lantern forum 1.6b final http://www.xmbforum.com http://www.aventure-media.co.uk Problems : - Reading of logs files - XSS - Path Disclosure - Access to users/admins accounts - Logs distortion Exploits : - /indexlog.log - /cplogfile.log - If indexlog not chmod 777 =...
XMB Forum 1.6 - Magic Lantern Cross-Site Scripting
XMB Forum 1.6 - Magic Lantern Cross-Site Scripting source: https://www.securityfocus.com/bid/4721/info XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. 1. The first involves...
CVE-1999-1384
Indigo Magic System Tour in the SGI system tour package systour for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program...
CVE-1999-1384
Indigo Magic System Tour in the SGI system tour package (systour) for IRIX 5.x–6.3 allows local users to gain root privileges via a Trojan horse .exitops program invoked by the inst command executed by RemoveSystemTour. The issue is localized to affected IRIX/SYSTOUR components and involves a use...
CVE-1999-1116
The CVE-1999-1116 entry concerns SGI IRIX 6.3 and 6.4, where the Indigo Magic System Administration subsystem’s runpriv component allows local users to gain root privileges due to an unspecified issue in its privilege handling. The vulnerability is described as enabling local privilege escalation...
XMB Forum 1.6 pre-beta - Image Tag Script Injection
XMB Forum 1.6 pre-beta - Image Tag Script Injection source: https://www.securityfocus.com/bid/4167/info The Extreme Message Board XMB 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between img and...