4609 matches found
CVE-2007-4143
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPa...
Design/Logic Flaw
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPa...
CVE-2007-4143
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPa...
CVE-2007-3974
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters...
Authentication flaw
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters...
Code injection
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
CVE-2007-3592
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
CVE-2007-3592
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields...
CVE-2007-3500
Xeweb XEForum allows remote attackers to gain privileges via a modified xeforum cookie...
Code injection
Xeweb XEForum allows remote attackers to gain privileges via a modified xeforum cookie...
CVE-2007-3500
Xeweb XEForum allows remote attackers to gain privileges via a modified xeforum cookie...
elkagroup Image Gallery 1.0 Remote SQL Injection Vulnerability
No description provided by source. --==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xpr...
Elkagroup Image Gallery 1.0 - SQL Injection
--==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SCRIPT DOWNLOAD: N/A SITE:...
Code injection
IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database...
CVE-2007-0068
IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database...
CVE-2007-2850
The Session Reliability Service XTE in Citrix MetaFrame Presentation Server 3.0, Presentation Server 4.0, and Access Essentials 1.0 and 1.5, allows remote attackers to bypass network security policies and connect to arbitrary TCP ports via a modified address:port string...
CVE-2007-1898
formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails spam via modified recipient, SETTINGSallowedemailhosts, and subject parameters...
Code injection
formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails spam via modified recipient, SETTINGSallowedemailhosts, and subject parameters...
CVE-2007-1925
The borrado function in modules/YourAccount/index.php in Tru-Zone Nuke ET 3.4 before fix 7 does not verify that account deletion requests come from the account owner, which allows remote authenticated users to delete arbitrary accounts via a modified cookie...