CVE-2005-1777

SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter...

CVE-2005-1778

Cross-site scripting XSS vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter...

CVE-2005-1777

SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter...

CVE-2005-1778

CVE-2005-1778 describes a cross-site scripting (XSS) vulnerability in PostNuke 0.750, exploitable via the start parameter in readpmsg.php. The affected component is readpmsg.php within PostNuke, enabling remote attackers to inject arbitrary web script or HTML. The available connected documents co...

CVE-2005-1777: Undefined Security Weakness

SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter...

CVE-2005-1778: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter...

CYBSEC - PHPMailer Infinite Loop Denial of Service

CYBSEC S.A. www.cybsec.com Advisory Name: PHPMailer Infinite Loop Denial of Service ============== Vulnerability Class: Denial of Service ==================== Release Date: 05.27.2005 ============= Affected Applications: ====================== PHPMailer = 1.72 Affected Platforms:...

postnuke -- multiple vulnerabilities

Postnuke Security Announcementss reports of the following vulnerabilities: missing input validation within /modules/Messages/readpmsg.php possible path disclosure within /user.php possible path disclosure within /modules/News/article.php possible remote code injection within /includes/pnMod.php...

postnukeInclusion.txt

Product : Postnuke 0.750 http://www.postnuke.com Description: Postnuke 0.750 - 0.760rc4 local file inclusion Severity: High Description =========== Postnuke is Web Content Management System written in PHP and using mysql as database backend. Detail ====== Directory traversal in function pnModFunc...

CVE-2005-1698

PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to 1 theme.php or 2 Xanthia.php in the Xanthia module, 3 user.php, 4 thelang.php, 5 text.php, 6 html.php, 7 menu.php, 8 finclude.php, or 9 button.php in the pnblocks directory in the Blocks...

CVE-2005-1698

CVE-2005-1698 affects PostNuke 0.750 and 0.760RC3, enabling remote attackers to obtain sensitive information through direct requests to a set of files across the Xanthia module, pnblocks directory, NS-Multisites module, and xmlrpc.php. The listed targets include theme.php, Xanthia.php, user.php, ...

CVE-2005-1696

The CVE-2005-1696 entry applies to PostNuke, affecting versions 0.750 and 0.760RC3. It describes multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via (1) the skin or (2) the paletteid parameter to demo.php in the Xanthia module, or (3...

CVE-2005-1694

Technical details (affected product/version, root cause, exploit, impact) are not publicly provided in the supplied documents; monitor for updates.

CVE-2005-1700

CVE-2005-1700 affects PostNuke 0.760-RC3 via the Xanthia module. The vulnerability is an SQL injection in pnadmin.php exploitable by the riga[0] parameter, allowing remote administrators to execute arbitrary SQL commands. Connected sources corroborate SQL injection in Xanthia/Messages areas and P...

CVE-2005-1696

Multiple cross-site scripting XSS vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 skin or 2 paletteid parameter to demo.php in the Xanthia module, or 3 the serverName parameter to config.php in the Multisites aka NS-Multisites...

CVE-2005-1700

SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga0 parameter...

CVE-2005-1697

The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to simplesmarty.php, which reveals the path in an error message...

CVE-2005-1695

Multiple cross-site scripting XSS vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 rssurl parameter to magpieslashbox.php, or the url parameter to 2 magpiesimple.php or 3 magpiedebug.php...

CVE-2005-1697

The CVE-2005-1697 issue affects PostNuke’s RSS module (versions 0.750 and 0.760 RC2/RC3). A direct request to simple_smarty.php exposes the installation path via an error message, enabling remote disclosure of sensitive information. Exploit details are not provided in the sources; no patch/versio...

CVE-2005-1699

CVE-2005-1699 : A directory traversal vulnerability exists in the Xanthia module’s pnadminapi.php (PostNuke 0.760-RC3). Remote administrators can read arbitrary files by supplying a .. (dot dot) in the skin parameter, enabling partial confidentiality impact. The provided documents do not specify ...