1501 matches found
CVE-2006-6554: Undefined Security Weakness
Unspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service segmentation fault and service stop via certain long LDAP queries, as demonstrated by vdkms6.pm...
CVE-2006-6283
CVE-2006-6283 affects Vikingboard 0.1.2 with multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via the subject field of private messages or bulletin board posts. The initial description specifies the affected vectors as the subject fie...
CVE-2006-5812: Undefined Security Weakness
Unspecified vulnerability in Kerio MailServer allows attackers to cause a denial of service, as demonstrated by vdkms4.pm, a "Kerio MailServer DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE...
CVE-2006-5813: Undefined Security Weakness
Unspecified vulnerability in Novell eDirectory 8.8 allows attackers to cause a denial of service, as demonstrated by vdnovell3.pm, a "Novell eDirectory 8.8 DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being...
CVE-2006-5792: Undefined Security Weakness
Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by vdxlink2.pm, an "Omni-NFS Enterprise remote exploit." NOTE: this is probably a different vulnerability than CVE-2006-5780. As of 20061107, this...
PT-2006-5230 · Phlymail · Phlymail Lite
Name of the Vulnerable Software and Affected Versions: PHlyMail Lite versions 3.4.4 and earlier Description: A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the PM pathhandler parameter. This is a different attack vector. Note that this issue has been...
CVE-2006-2914: Undefined Security Weakness
PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder parameter to 1 postreply.php, 2 posting.php, 3 and pm/newpm.php in the deluxe/ directory, and 4 postreply.php, 5 posting.php, and 6 pm/newpm.php in the defaul...
Invision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit
Exploit for unknown platform in category web applications ================================================================== Invision Power Board = 2.1.5 fromcontact SQL Injection Exploit ================================================================== !/usr/bin/perl IPB =2.1.4 exploit possibly...
Invision Power Board 2.1.5 - from_contact SQL Injection
Invision Power Board 2.1.5 - fromcontact SQL Injection !/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the...
CVE-2006-2097
SQL injection vulnerability in funcmsg.php in Invision Power Board IPB 2.1.4 allows remote attackers to execute arbitrary SQL commands via the fromcontact field in a private message PM...
CVE-2006-2097
SQL injection vulnerability in funcmsg.php in Invision Power Board IPB 2.1.4 allows remote attackers to execute arbitrary SQL commands via the fromcontact field in a private message PM...
ibp-2.1.4-xpl.txt
This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in funcmsg.php on line 448. tobyid is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized inp...
SQL injection exploit IPB <= 2.1.4
This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested. Simple SQL injection in funcmsg.php on line 448. tobyid is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized inp...
CVE-2005-3777
MyBB 1.0 PR2 Rev 686 is affected by a vulnerability that allows remote attackers to delete or move private messages (PM) by submitting modified fields in the inbox form. The provided documents confirm the affected software and the manipulation vector, but do not specify root cause details beyond ...
CVE-2005-0878
MercuryBoard before 1.1.3 is affected by CVE-2005-0878: an XSS flaw in the title field of private messages that lets remote attackers inject arbitrary script/HTML. Root cause: insufficient input sanitization in the PM title. Impact: could compromise user sessions or integrity of rendered pages as...
CVE-2005-0878
Cross-site scripting XSS vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM private message...
CVE-2005-0878: Undefined Security Weakness
Cross-site scripting XSS vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM private message...
CVE-2005-0878
Cross-site scripting XSS vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM private message...
CVE-2005-0631
CVE-2005-0631 affects PBLang BBS (version around 4.63) with a vulnerability in delpm.php where a logged-in, remote user can delete arbitrary personal messages by altering the id and a parameters. The issue stems from improper handling of these parameters, enabling unauthorized PM deletion within ...
HRG009.txt
HRG - Hackerlounge Research Group Release: HRG009 Monday 03/01/05 Software PBLang 4.63 delpm.php authentication problem The author can't be held responsible for any damage done by a reader. You have your own resonsibility Please use this document like it's meant to. Vulnerable: PBLang 4.63 and...