3872 matches found
PHPepperShop 1.4 - 'shop/Admin/SHOP_KONFIGURATION.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/32690/info PhPepperShop is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...
Design/Logic Flaw
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653...
CVE-2008-5318
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653...
CVE-2008-5318
CVE-2008-5318 affects Tiki Wiki CMS Groupware prior to 2.2; the issue is described as an input sanitation weakness related to the size of user-provided input. Exploitation details and exact impact are not provided in the CVE description, but a public NES/OPENVAS entry classifies it as an input sa...
CVE-2008-5318
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653...
Fixed in Apache Tomcat 5.5.27
Low: Cross-site scripting CVE-2008-1232 The message argument of HttpServletResponse.sendError call is not only displayed on the error page, but is also used for the reason-phrase of HTTP response. This may include characters that are illegal in HTTP headers. It is possible for a specially crafted...
Debian DSA-1592-1 : linux-2.6 - heap overflow
Two vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or arbitrary code execution. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-1673 Wei Wang from McAfee reported a potential heap overflow in the ASN.1...
[SECURITY] Fedora 7 Update: xfce4-weather-plugin-0.6.2-2.fc7
A weather plugin for the Xfce panel. It shows the current temperature and weather condition, using weather data provided by xoap.weather.com...
[Full-disclosure] firefox 2.0.0.2 crash
Can be dupe but in fast browsing over topics I did not discovered this exploit: http://people.zoy.org/sam/firefox-crash-save-session-before-clicking.gif I do NOT know anything else than this url. Just seen it in random discussion and anyone else I asked knows nothing. Current tests indicate that...
CVE-2007-1325
The PMAArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service web server crash via an array with many dimensions. NOTE: it could be argued tha...
phpAutoMembersArea <= 3.2.5 (installed_config_file) Remote Inclusion
No description provided by source. +-------------------------------------------------------------------- + + phpAutoMembersArea 3.2.5 $installedconfigfile Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: phpAutoMembersArea 3.2....
[Full-disclosure] MS06-060 Microsoft Word Memmove Code Execution
McAfee, Inc. McAfee Avert Labs Security Advisory Vendor Notification Date: 2006-07-06 Public Release Date: 2006-10-10 Microsoft Word Memmove Code Execution CVE-2006-3647 Synopsis An integer bug stack overflow exists in the Microsoft Word file format. The file format allows a attacker to create a...
Comdev Photo Gallery 3.1 :) <= Remote File Inclusion
+-------------------------------------------------------------------- + + Comdev Photo Gallery 3.1 : = Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: Comdev Photo Gallery 3.1 + Venedor ...........: http://www.comdevweb.com +...
[KAPDA::#47] - myNewsletter 1.1.2 SQL_Injection
KAPDA::47 - myNewsletter 1.1.2 SQLInjection SQLInjection ------- KAPDA New advisory Vulnerable products : myNewsletter = 1.1.2 Vendor: http://www.aspburst.com/index.asp Risk: Medium Vulnerability: SQLInjection Date : -------------------- Found : 2006/06/05 Vendor Contacted : 2006/06/06 Release Da...
vulnerability details
Release Date: 03/01/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at gmail.com Vendor Status: Confirmed Product Overview cited from SAP :...
CVE-2006-1659
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in imagedesc.php, 2 provided parameter in template.php, 3 cid parameter in suggestimage.php, 4 imgid parameter in insertrating.php, and 5 cid parameter i...
[eVuln] E-Blah Platinum 'Referer' XSS Vulnerability
New eVuln Advisory: E-Blah Platinum 'Referer' XSS Vulnerability http://evuln.com/vulns/83/summary.html --------------------Summary---------------- eVuln ID: EV0083 CVE: CVE-2006-0829 Software: E-Blah Platinum Sowtware's Web Site: http://www.eblah.com Versions: 9.7 Critical Level: Moderate Type:...
EV0083.txt
New eVuln Advisory: E-Blah Platinum 'Referer' XSS Vulnerability http://evuln.com/vulns/83/summary.html --------------------Summary---------------- eVuln ID: EV0083 CVE: CVE-2006-0829 Software: E-Blah Platinum Sowtware's Web Site: http://www.eblah.com Versions: 9.7 Critical Level: Moderate Type:...
[eVuln] PHP iCalendar File Inclusion Vulnerability
New eVuln Advisory: PHP iCalendar File Inclusion Vulnerability http://evuln.com/vulns/70/summary.html --------------------Summary---------------- eVuln ID: EV0070 Software: PHP iCalendar Sowtware's Web Site: http://phpicalendar.net/ Versions: 2.0.1 2.1 2.2 Critical Level: Dangerous Type: File...
CVE-2005-0131
The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users...