Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in zones.php in Inprotect 0.21 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Description field. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-1270

Multiple cross-site scripting XSS vulnerabilities in zones.php in Inprotect 0.21 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Description field. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in issue/createissue.aspx in Gemini 2.0 allows remote attackers to inject arbitrary web script or HTML via the rtcDescription$RadEditor1 field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Design/Logic Flaw

PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Woltlab Burning Board wBB allow remote attackers to inject arbitrary web script or HTML via 1 the username parameter to galerieindex.php and possibly 2 galerieonfly.php. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-1019

Cross-site scripting XSS vulnerability in fce.php in UKiBoard 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a BBCode url tag when using the showpost function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Information disclosure

LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1005

agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AGID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Information disclosure

agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AGID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

DISPUTED SQL injection vulnerability in VCS Virtual Program Management Intranet VPMi Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to ServiceRequests.asp. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

CVE-2006-0897

SQL injection vulnerability in VCS Virtual Program Management Intranet VPMi Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to ServiceRequests.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Cross-site scripting XSS vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "javascript:." NOTE: the provenance of this information is...

CVE-2006-0794

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Design/Logic Flaw

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

USN-252-1: gnupg vulnerability

Tavis Ormandy discovered a potential weakness in the signature verification of gnupg. gpgv and gpg --verify returned a successful exit code even if the checked file did not have any signature at all. The recommended way of checking the result is to evaluate the status messages, but some third par...

dotProject Multiple Scripts Remote File Inclusion

The remote host is running dotProject, a web-based, open source, project management application written in PHP. The installed version of dotProject fails to sanitize input to various parameters and scripts before using it to include PHP code. Provided PHP's 'registerglobals' setting is enabled, a...

[Full-disclosure] Privilege Scalation for Windows Networks using weak Service restrictions v2.0 exploit

Proof of concept of Sudhakar Govindavajhala and Andrew Appel paper http://www.cs.princeton.edu/sudhakar/papers/winval.pdf Running as an unprivileged user you can test if your services are vulnerable and can be used to install a backdoor. Both source code and binary included Microsoft advisory:...

CPAINT AJAX Library Cross Site Scripting

GulfTech Security Research February 9, 2006 Vendor : CPAINT URL : http://sourceforge.net/projects/cpaint Version : CPAINT = 2.0.2 Risk : Cross Site Scripting Description: CPAINT Cross-Platform Asynchronous INterface Toolkit is a multi-language toolkit that helps web developers design and implemen...

MS Windows Services ACLs Local Privilege Escalation Exploit (updated)

Exploit for unknown platform in category local exploits ===================================================================== MS Windows Services ACLs Local Privilege Escalation Exploit updated ===================================================================== / Privilege Scalation for Windows...