CVE-2006-1397

Multiple cross-site scripting XSS vulnerabilities in a phpAdsNew and b phpPgAds before 2.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 certain parameters to the banner delivery module, which is not properly handled in the administrator interface, or 2 certain...

phpPGAds/phpAdNew < 2.0.8 Multiple Injection Vulnerabilities

Binary data 3488.prm...

[Full-disclosure] [PHPADSNEW-SA-2006-001] phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilities

======================================================================== phpAdsNew / phpPgAds security advisory PHPADSNEW-SA-2006-001 ------------------------------------------------------------------------ Advisory ID: PHPADSNEW-SA-2006-001 Date: 2006-Mar-27 Security risk: medium risk Applicatio...

CVE-2005-3791

The vulnerability CVE-2005-3791 affects PHPAdsNew and phpPgAds up to version 2.0.6. The root cause is an HTTP response splitting flaw in adclick.php (and possibly other vectors), allowing remote attackers to inject arbitrary HTML headers. Reported impact: confidentiality unaffected, integrity par...

CVE-2005-3791

HTTP response splitting vulnerability in phpAdsNew and phpPgAds 2.0.6 and earlier allows remote attackers to inject arbitrary HTML headers via adclick.php and possibly other unspecified vectors...

CVE-2005-3645

phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allows remote attackers to obtain the application installation path and other sensitive information via direct requests to 1 create.php, and if displayerrors is enabled, 2 lib-updates.inc.php, 3 lib-targetstats.inc.php, 4 lib-size.inc.php...

CVE-2005-3646

Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in 1 logout.php and 2 index.php...

CVE-2005-3645

phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allows remote attackers to obtain the application installation path and other sensitive information via direct requests to 1 create.php, and if displayerrors is enabled, 2 lib-updates.inc.php, 3 lib-targetstats.inc.php, 4 lib-size.inc.php...

CVE-2005-3646

Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in 1 logout.php and 2 index.php...

CVE-2005-3645

CVE-2005-3645 affects phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions. The issue allows remote disclosure of the application installation path and other sensitive information via direct requests to create.php, and (if display_errors is enabled) to lib-updates.inc.php, lib-targetstats.i...

CVE-2005-3646

CVE-2005-3646 concerns multiple SQL injection flaws in lib-sessions.inc.php of phpAdsNew and phpPgAds 2.0.6 (and earlier) . The vulnerabilities allow remoto attackers to inject SQL via the sessionID parameter in both logout.php and index.php . The issue is documented with a high impact (CVSS base...

phpAdsNew / phpPgAds < 2.0.6 Multiple Vulnerabilities

The remote host is running phpAdsNew / phpPgAds, an open source banner ad server. The version of phpAdsNews / phpPgAds installed on the remote host suffers from several flaws : - Remote PHP Code Injection Vulnerability The XML-RPC library bundled with the application allows an attacker to inject...

CVE-2005-2636

SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2005-2635

Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. dot dot in the 1 layerstyle parameter to adlayer.php or 2 language parameter to js-form.php...

CVE-2005-2636

The CVE-2005-2636 issue affects phpAdsNew/phpPgAds prior to version 2.0.6, where the libraries/lib-view-direct.inc.php clientid parameter enables SQL injection. This allows remote attackers to execute arbitrary SQL commands against the backend. The only concrete detail available is that the vulne...

CVE-2005-2636

SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2005-2635

Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. dot dot in the 1 layerstyle parameter to adlayer.php or 2 language parameter to js-form.php...

CVE-2005-2635

CVE-2005-2635 affects phpAdsNew/phpPgAds prior to 2.0.6. The vulnerabilities are directory traversal / local file inclusion via unsanitized user input: the layerstyle parameter to adlayer.php and the language parameter to admin/js-form.php. Root cause is improper input validation used to include ...

security flaw

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier PEAR XML-RPC for PHP, as used in multiple products including 1 Drupal, 2 phpAdsNew, 3 phpPgAds, and 4 phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be...

[SECURITYREASON.COM] phpAdsNew/phpPgAds 2.0.5 Local file inclusion cXIb8O3.16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpAdsNew/phpPgAds 2.0.5 Local file inclusion cXIb8O3.16 Author: Maksymilian Arciemowicz cXIb8O3 from SECURITYREASON.COM TEAM Date: 14.07.2005 01:54 GMT+01.00 - --- 0.Description --- phpAdsNew is an open-source ad server, with an integrated banner...