CVE-2006-0201

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipnsuccess.php...

CVE-2006-0202

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

CVE-2006-0202

CVE-2006-0202 affects PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier. The issue is due to insecure filesystem permissions: ipn/logs/ipn_success.txt is world-readable, allowing local users to view payment data, and ipn/logs is world-writable, enabling local users to delete or repl...

Multiple PHP Toolkit for PayPal Vulnerabilities

Vendor: Patrick Breitenbach and Dave Nielsen http://paypal.sf.net/ Versions affected: PHP Toolkit for PayPal v0.50 and may be prior Date: 12th January 2006 Type of Vulnerability: Sensitive Information Disclosure and Payment System Bypass Severity: Critical Solution Status: Unpatched Vendor was...

AlstraSoft EPay Enterprise v3.0 XSS vuln.

AlstraSoft EPay Enterprise v3.0 XSS vuln. Vuln. discovered by : r0t Date: 23 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/alstrasoft-epay-enterprise-v30-xss.html vendor:www.alstrasoft.com/epayenterprise.htm affected version:v3.0 and prior Product Description: EPay Enterprise...

Blog System v1.2 SQL inj. vuln.

Blog System v1.2 SQL inj. vuln. Vuln. dicovered by : r0t Date: 5 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/blog-system-v12-sql-inj-vuln.html vendor:http://www.netartmedia.net/blogsystem/ affected version:v1.2 and prior Product Description: Blog System allows you to launch and...

AlstraSoft EPay Pro "pmodule" SQL Injection Vulnerability

AlstraSoft EPay Pro "pmodule" SQL Injection Vulnerability Vuln. dicovered by : r0t Vendor:http://www.alstrasoft.com/ Product link: http://www.alstrasoft.com/epay.htm affected version:v2.0 Product Overview: How would you like to own your very own payment processing website and business built with...

Template Seller Pro 3.25

AlstraSoft Template Seller Pro 3.25 =================================== Software: AlstraSoft Template Seller Pro 3.25 Severity: Arbitrary code execution, SQL Injections Risk: High Author: Robin Verton [email protected] Date: Nov. 15 2005 Vendor: www.alstrasoft.com Description: Ever thought of...

aMemberXSS.txt

------------------------------------------------------ Nightmare TeAmZ Advisory 014 ------------------------------------------------------ Date - 11/2005 aMember Xss AFFECTED PRODUCTS ================= aMember http://www.amember.com OVERVIEW ======== aMember is a flexible membership software with...

efriends.txt

AlstraSoft E-Friends Remote command exucetion Site : http://www.alstrasoft.com/efriends.htm Description : AlstraSoft E-Friends is an online social networking software that allows you to start your own site just like Friendster and Tribe.net. The E-Friends software allows members to connect to...

HYA-2005-008-alstrasoft-epay-pro.txt

------------------------------------------------------ HYA-2005-008 h4cky0u.org Advisory 008 ------------------------------------------------------ Date - Mon Sep 19 2005 TITLE: ====== Alstrasoft Epay Pro 2.0 and prior Directory Traversal Vulnerability SEVERITY: ========= Medium SOFTWARE: =======...

[NewAngels Advisory] aMember Pro 2.3.X - Remote File Include Vulnerability

NewAngels Advisory 2 aMember Pro 2.3.X - Remote File Include Vulnerability ======================================================================== ===== Software: aMember Pro 2.3.4 Type: Remote PHP File Include Vulnerability Risk: High Date: Aug. 16 2005 Vendor: CGI Central Credit: =======...

CVE-2005-0981

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 payment or 2 send parameter...

CVE-2005-0285

Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs...

PHPCart - Input Validation

PHPCart - Input Validation source: https://www.securityfocus.com/bid/13406/info PHPCart is prone to a remote input validation vulnerability. The issue exists because the software fails to sufficiently sanitize URI parameter data that is employed when computing product charges. A remote attacker m...

PHPCart - Input Validation

source: https://www.securityfocus.com/bid/13406/info PHPCart is prone to a remote input validation vulnerability. The issue exists because the software fails to sufficiently sanitize URI parameter data that is employed when computing product charges. A remote attacker may exploit this issue to...

CVE-2005-0981

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 payment or 2 send parameter...

CVE-2005-0981: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 payment or 2 send parameter...

CVE-2005-0288

CVE-2005-0288 concerns the Bottomline Webseries Payment Application. The change-password function does not require the old password when setting a new one, which could allow an authenticated user to change other users’ passwords. The description provided does not specify affected versions/builds ...

CVE-2005-0285

Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs...