MDPro 1.0.76 - Cookie PNSVlang Local File Inclusion

MDPro 1.0.76 - Cookie PNSVlang Local File Inclusion DEVIL TEAM IRC: 72.20.18.6:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patrio...

MDPro 1.0.76 - 'Cookie PNSVlang' Local File Inclusion

DEVIL TEAM IRC: 72.20.18.6:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patriots : - Leito & Leon TomZen, Gelo, Ramzes, DMX, Ci2u,...

CVE-2006-4964

Cross-site scripting XSS vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via 1 vectors that bypass the XSS protection mechanisms of the pnVarCleanFromInput function, and 2 unspecified vectors related to the AntiCracker...

CVE-2006-4964

Cross-site scripting XSS vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via 1 vectors that bypass the XSS protection mechanisms of the pnVarCleanFromInput function, and 2 unspecified vectors related to the AntiCracker...

CVE-2006-4964

MAXdev MDPro contains a cross-site scripting (XSS) vulnerability in versions prior to 1.0.76, fixed in a release after 20060918. The issue arises from vectors that bypass the pnVarCleanFromInput XSS protections and from unspecified AntiCracker-related vectors. Affected product/component: MAXdev M...

PT-2006-5707 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro versions prior to 1.0.76 updated before 20060918 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved through vectors that bypass the XSS protection...

JVN#46630603 MDPro cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected MDPro version 1.0.76 and earlier...

Sql injection

SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro MD-Pro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in...

Design/Logic Flaw

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...

CVE-2006-1676

SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro MD-Pro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in...

CVE-2006-1677

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...

CVE-2006-1676

MAXdev MDPro MD-Pro

CVE-2006-1677

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...

CVE-2006-1676

SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro MD-Pro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in...

CVE-2006-1677

CVE-2006-1677 affects MAXdev MDPro versions prior to 1.076, including 1.0.72/1.0.73. Root cause is an insecure direct access path to includes/legacy.php that allows remote attackers to obtain the server’s full filesystem path. Impact is partial confidentiality exposure (full path disclosure) with...