waraxe-2004-SA015.txt

================================================================================ waraxe-2004-SA015 ================================================================================ Multiple vulnerabilities in NukeCalendar v1.1.a...

NukeCalendar 1.1.a - 'block-Calendar1.php' Full Path Disclosure

source: https://www.securityfocus.com/bid/10082/info NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities. These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive...

[waraxe-2004-SA#011 - Multiple vulnerabilities in MS Analysis v2.0 module for PhpNuke]

================================================================================ waraxe-2004-SA011 ================================================================================ Multiple vulnerabilities in MS Analysis v2.0 module for PhpNuke...

CVE-2004-1839

MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to 1 browsers.php, 2 mstrack.php, or 3 title.php, which reveal the full path in a PHP error message...

CVE-2004-1840

Multiple cross-site scripting XSS vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the 1 screen parameter to modules.php, 2 modulename parameter to title.php, 3 sortby parameter to modules.php, or 4 overview parameter to...

PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection

PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection source: https://www.securityfocus.com/bid/9948/info Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using ...

PHP-Nuke MS-Analysis Module - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/9947/info It has been reported that MS-Analysis is prone to a multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI parameters. These issues could permit a remote attacke...

CVE-2004-0265

This CVE concerns a Cross-site Scripting (XSS) vulnerability in Php-Nuke 6.x-7.1.0, specifically in modules.php. The vulnerability allows remote attackers to execute arbitrary script as other users by manipulating URL-encoded parameters (1) title or (2) fname in the News or Reviews modules. Affec...

CVE-2004-0266

Affects Php-Nuke 6.x to 7.1.0 where the SQL injection vulnerability is in the public_message capability (c_mid parameter) that can disclose the administrator password. Exploitation details or specific patches are not provided in the connected documents. The OpenVAS/Nessus references confirm long-...

CVE-2004-1830

error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid 1 language, 2 newlang, or 3 lang parameter, which leaks the pathname in a PHP error message...

CVE-2004-0266

SQL injection vulnerability in the "public message" capability publicmessage for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain the administrator password via the cmid parameter...

CVE-2004-0265

Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...

CVE-2004-0269

CVE-2004-0269 concerns a SQL injection vulnerability in PHP-Nuke 6.9 and earlier (and possibly 7.x). The vulnerability enables remote attackers to inject arbitrary SQL code and potentially read sensitive information via input in two modules: (1) the category variable in the Search module and (2) ...

CVE-2004-0269

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via 1 the category variable in the Search module or 2 the admin variable in the WebLinks module...

PHP-Nuke Error Manager Module 2.1 - 'error.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors. These issues may be leveraged to carry out...

PHP-Nuke Error Manager Module 2.1 - error.php?language Full Path Disclosure

PHP-Nuke Error Manager Module 2.1 - error.php?language Full Path Disclosure source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional...

CVE-2004-0269: Undefined Security Weakness

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via 1 the category variable in the Search module or 2 the admin variable in the WebLinks module...

CVE-2004-0265: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...

CVE-2004-0266: Undefined Security Weakness

SQL injection vulnerability in the "public message" capability publicmessage for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain the administrator password via the cmid parameter...

PHP-Nuke Error Manager Module 2.1 - error.php Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke Error Manager Module 2.1 - error.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle...