[Full-disclosure] [vuln.sg] Cybozu Garoon 2 SQL Injection Vulnerabilities

vuln.sg Vulnerability Research Advisory Cybozu Garoon 2 SQL Injection Vulnerabilities by Tan Chew Keong Release Date: 2006-08-28 Summary ------- Some SQL injection vulnerabilities have been found in Cybozu Garoon 2. When exploited by a logon user, the vulnerabilities allow manipulation of SQL...

miniBloggie <= 1.0 (fname) Remote File Inclusion Vulnerability

--------------------------------------------------------------------------------------- miniBloggie 1.0 fname Remote File Inclusion --------------------------------------------------------------------------------------- Author : Sh3ll Date : 2006/05/01 HomePage : http://www.sh3ll.ir Contact :...

[Full-disclosure] CounterChaos <= 0.48c SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: CounterChaos = 0.48c SQL Injection Vulnerability Release Date: 2006/08/04 Last Modified: 2006/08/03 Author: Tamriel tamriel at gmx dot net Application: CounterChaos = 0.48c Risk: Moderate Vendor Status: not contacted Vendor Site:...

dnGuestbook <= 2.0 Remote SQL Injection Vulnerabilities

No description provided by source. / | | | | | SECURITY ADVISORY | | | | | /¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ advisory: dnGuestbook = v2.0 remote sql injection vulnerability release: 2006-04-08 author: snatcher snatcher at gmx.ch country: switzerland |+| application: dnGuestbook =...

Design/Logic Flaw

The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is available for these...

CVE-2006-1210

The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is available for these...

[Full-disclosure] Password disclosure and remote access in Netcool/NeuSecure Security information management platform

Multiple security information disclosure paths and remote access Netcool/NeuSecure Security information management platform . Cleartext-storage of passwords in the configuration file Cleartext reporting of user password in the log Default backend Mysql database user and remote access. Laxed...

BuHa-7.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 --------------------------------------------------- | BuHa Security-Advisory 7 | Feb 14th, 2006 | --------------------------------------------------- | Vendor | Mantis BT | | URL | http://www.mantisbt.org/ | | Version | /manageuserpage.php: GET:...

DBeSession102.txt

GulfTech Security Research February 11, 2006 Vendor : Lawrence Osiris URL : http://www.phpclasses.org/browse/package/1624.html Version : DBeSession 1.0.2 Risk : SQL Injection Description: DBeSession is a feature-packed PHP class that stores the session data in a MySQL database rather than files. ...

kapda-26.txt

KAPDA New advisory Vendor: http://www.jaia-interactive.com Vulnerable: Version: 1.2.3 Bug: Sql Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- MyTopix is a PHP-based message board system that uses a MySQL database. Vulnerability: -------------------...

CVE-2005-4626

The default configuration of Recruitment Software installs admin/site.xml under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information MySQL database credentials via a direct request...

CVE-2005-4626

The default configuration of Recruitment Software installs admin/site.xml under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information MySQL database credentials via a direct request...

Jamit Job Board 2.4.x SQL inj.

Jamit Job Board 2.4.x SQL inj. Vuln. dicovered by : r0t Date: 14 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/jamit-job-board-24x-sql-inj.html vendor:http://www.jamit.com.au/ affected version:2.4.1 and prior Product Description: Job Board Pro is a PHP application for running and...

SMF11SQL.txt

KAPDA New advisory Vendor: http://www.simplemachines.org/ Vulnerable Version:SMF 1.1 rc1, Other versions also may be affected. Bug: SQL Injection Exploitation: Remote with browser Description: -------------------- Simple Machines Forum is a most widely used PHP-based message board system that use...

[KAPDA::#15] - ThWboard multiple vulnerabilities

KAPDA New advisory Vendor: http://www.thwboard.de Vulnerable Version: 3 beta 2.8 Bug: HTML Injection , XSS , SQL Injection Exploitation: Remote with browser Description: -------------------- ThWboard is a freely available German PHP-based message board program that uses a MySQL database...

athena.txt

Language: PHP Script: Athena Version: 0.1a Official website: http://sourceforge.net/projects/athena Problem: Remote file inclusion Discovered by: beford & GB Description: =========== A simple website management system written in oo php that uses a mysql database to store user and group rights and...

vbullXSS.txt

re, submissionsatpacketstormsecurity.org. http://nshell.h15.ru/advisory's/vBulletin%203.5.1xss.txt ========================================================= = N Shell : advizory = ========================================================= PRODUCT: vBulletin 3.5.1 DESCRIPTION: vBulletin is a...

Bugs Land Down Under v800

Bugs Land Down Under v800 PHP/MySQL Website engine Copyright Neocrome - http://www.neocrome.net --------------------------------------------- Sql Injection and Cross Site Scripting Problem examlple : /ldu/forums.php?m=topics&s=' /ldu/list.php?c=articles&s=title&w=asc&o='&p=1...

USN-96-1: mySQL vulnerabilities

Stefano Di Paola discovered three privilege escalation flaws in the MySQL server: - If an authenticated user had INSERT privileges on the 'mysql' administrative database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the...

[SCAN Associates Security Advisory] vbulletin 3.0.6 and below php code injection

Summary: vbulletin 3.0.6 and below php code injection Description =========== vBulletin is a powerful, scalable and fully customizable forums package for your web site. It has been written using the Web's quickest-growing scripting language; PHP, and is complimented with a highly efficient and...