1054 matches found
YABB SE 1.x - SSI.php ID_MEMBER SQL Injection
YABB SE 1.x - SSI.php IDMEMBER SQL Injection source: https://www.securityfocus.com/bid/9449/info A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks. It has been reported that a problem exists in the SSI.php script distributed as part of YaBB SE. Due to...
XtremeASP PhotoGallery 2.0 - Adminlogin.asp SQL Injection
XtremeASP PhotoGallery 2.0 - Adminlogin.asp SQL Injection source: https://www.securityfocus.com/bid/9438/info XtremeASP PhotoGallery is prone to an SQL injection vulnerability. The issue is reported to exist in the administration login interface, which does not sufficiently sanitize user-supplied...
WzdFTPD 0.1 rc5 - Login Remote Denial of Service
source: https://www.securityfocus.com/bid/8678/info It has been reported that wzftpd is prone to a remote denial of service condition due to malicious user-supplied input. The problem is reported to present itself when a remote attacker sends a single CRLF character to the vulnerable program duri...
PHP-Nuke 6.0/6.5 Forum Module - 'viewforum.php' SQL Injection
source: https://www.securityfocus.com/bid/7194/info It has been reported that an input validation error exists in the 'viewforum.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker ...
NETGEAR ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service
NETGEAR ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service source: https://www.securityfocus.com/bid/7166/info It has been reported that some ProSafe VPN Firewall devices do not properly handle some types of input. Because of this, a remote user could potentially send malicious inpu...
Netgear ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service
source: https://www.securityfocus.com/bid/7166/info It has been reported that some ProSafe VPN Firewall devices do not properly handle some types of input. Because of this, a remote user could potentially send malicious input to the device that would result in a crash, and potential denial of...
phpBB 2.0.3 - 'privmsg.php' SQL Injection
source: https://www.securityfocus.com/bid/6634/info A SQL injection vulnerability has been reported for phpBB2 systems that may result in the deletion of all private messages. phpBB2, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries to...
Xoops 1.3.5 - Private Message System Font Attributes HTML Injection
source: https://www.securityfocus.com/bid/6344/info Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible for an attacker to supply malicious...
EmuMail 5.0 - Web Root Full Path Disclosure
source: https://www.securityfocus.com/bid/5823/info Emumail is an open source web mail application. It is available for the Unix, Linux, and Microsoft Windows operating systems. Under some conditions, Emumail may reveal sensitive configuration information. When unexpected characters are inserted...
Microsoft SQL Server 2000 - sp_MScopyscript SQL Injection
source: https://www.securityfocus.com/bid/5309/info The Microsoft SQL Server 2000 spMScopyscript stored procedure does not sufficiently validate input before passing it to the xpcmdshell extended stored procedure. An attacker with the ability to execute a query or pass malicious input to a query...
CaupoShop: cross-site-scripting bug
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following cross-site-scripting bug in CaupoShop and probably in CaupoShopPro: Details - ------- Product: CaupoShop and probably CaupoShopPro Version: 1.30a CaupoShop and maybe all versions before OS affected: all OS with php and...
PHPLib Team PHPLIB 7.2 - Remote Script Execution
source: https://www.securityfocus.com/bid/3079/info The PHP Base Library'PHPLIB' is a code library which provides support for session management in web applications. It is targeted to developers and is widely used in many web applications, so a strong possibility exists that an application may be...
Xmail 0.50.6 CTRLServer - Arbitrary Commands
Xmail 0.50.6 CTRLServer - Arbitrary Commands // source: https://www.securityfocus.com/bid/2360/info Versions of CTRLServer are vulnerable to malicious user-supplied input. A failure to properly bounds-check data passed to the cfgfileget command leads to an overflow, which, properly exploited, can...
