athena.txt

Language: PHP Script: Athena Version: 0.1a Official website: http://sourceforge.net/projects/athena Problem: Remote file inclusion Discovered by: beford & GB Description: =========== A simple website management system written in oo php that uses a mysql database to store user and group rights and...

Bugs Land Down Under v800

Bugs Land Down Under v800 PHP/MySQL Website engine Copyright Neocrome - http://www.neocrome.net --------------------------------------------- Sql Injection and Cross Site Scripting Problem examlple : /ldu/forums.php?m=topics&s=' /ldu/list.php?c=articles&s=title&w=asc&o='&p=1...

USN-96-1: mySQL vulnerabilities

Stefano Di Paola discovered three privilege escalation flaws in the MySQL server: - If an authenticated user had INSERT privileges on the 'mysql' administrative database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the...

[SCAN Associates Security Advisory] vbulletin 3.0.6 and below php code injection

Summary: vbulletin 3.0.6 and below php code injection Description =========== vBulletin is a powerful, scalable and fully customizable forums package for your web site. It has been written using the Web's quickest-growing scripting language; PHP, and is complimented with a highly efficient and...

AppServ 2.5.x and Prior Exploit

what AppServ ========== AppServ is the Apache/PHP/MySQL open source software installer packages. Objective : - Easy to buid Webserver and Database Server - For those who just beginning client/server programming. - For web programmers/developers using PHP & MySQL. - For programming techniques that...

MySQL Database Client Detection

Binary data 5136.prm...

Major Cpanel Expliot HTML Injection

Major Bug found 6/7/04 Discovered by Verb0s Reseller accounts with cpanel, in the password modification page, can insert a basic injection ex:http://domain:2086/scripts/passwd?password=&domain=&user= The code will modify all the mysql database passwords, in which the reseller shouldnb't have...

phpx324.txt

PHPX 3.2.4 http://www.phpx.org Versions Affected: PHPX 2.x - 3.2.4 Type of bug: Session Hi-jacking/Admin Access via Cookies Impact: Ability to steal another users account Found-by: HelloWorld Ryan Wray Vendor: Notified Table Of Contents ===================== 1 The Program 2 The Problem 3 The Proo...

jelsoftvb.txt

Vendor : Jelsoft Enterprises URL : http://www.vbulletin.com Version : vBulletin 3.0.0 RC4 && Others Risk : Cross Site Scripting Description: vBulletin is a powerful, scalable and fully customisable forums package for your web site. Based on the PHP language, backed with a blisteringly fast MySQL...

[Full-Disclosure] GLSA: vpopmail (200310-01)

GENTOO LINUX SECURITY ANNOUNCEMENT --------------------------------------------------------------------- PACKAGE : vpopmail SUMMARY : Insecure file permissions. DATE : 2003-10-02 18:28 UTC EXPLOIT : local VERSIONS AFFECTED : =5.2.1-r5 FIXED VERSION : 5.2.1-r6 GENTOO BUG : 23502 CVE : none known a...

DSA-381 mysql - buffer overflow

Bulletin has no description...

Owl_Intranet_Engine.txt

-------------------------------------------------- Owl Intranet Engine - File Disclosure Vulnerabilty -------------------------------------------------- Date: 5-12-03 Advisory Url: http://sec.angrypacket.com/advisories.phtml Vendor Home Page: http://owl.sourceforge.net/ Vendor Project Page:...

Multiple SQL injection on OpenBB forums

/----------------------------------------------------------------------------- | 7 A 6 9 - A d v C: 008 |-----------------------------------------------------------------------------| | | SQL injection on OpenBB forums | ----------------------------------------------------------------------------...

CVE-2002-1809

The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database...

XSS bug in MyMarket 1.71

+----------------------+ | XSS in MyMarket 1.71 | +----------------------+ Product Description =================== MyMarket is a fully functional online shopping catalog system, built using PHP and MySQL. It was created by Ying Zhang for the purpose of teaching people about the basics of creating...

AdCycle does not adequately validate user input thereby allowing for SQL injection

Overview AdCycle does not adequately filter user input, allowing remote attackers to execute arbitrary MySQL queries. Description AdCycle is a shareware banner ad management system written in Perl and designed to work with a MySQL database. AdCycle does not adequately filter multiple unspecified...

Noguska Nola 1.1.1 [ Intranet Business Management Software ]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Noguska Nola 1.1.1 Intranet Business Management Software .: Software Desciption :. - - compied from their site - Redefining the scope of Enterprise Software The NOLA web based software package allows your business to effortlessly reach further than...

Noguska Nola 1.1.1 [ Intranet Business Management Software ]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Noguska Nola 1.1.1 Intranet Business Management Software .: Software Desciption :. - -- compied from their site -- Redefining the scope of Enterprise Software The NOLA web based software package allows your business to effortlessly reach further than...

CVE-2001-1255

WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database...

WikkiTikkiTavi 0.x - Remote File Inclusion

source: https://www.securityfocus.com/bid/3946/info WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on...