469 matches found
CVE-2006-3532
PHP file inclusion vulnerability in includes/editnew.php in Pivot 1.30 RC2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Pathsextensionspath parameter...
CVE-2006-3532
Pivot 1.30 RC2 and earlier are affected by a PHP file inclusion vulnerability in includes/edit_new.php when register_globals is enabled. An attacker can supply a FTP URL or full file path in Paths[extensions_path] to execute arbitrary PHP code remotely. The issue enables partial impact to confide...
CVE-2006-3533
Multiple cross-site scripting XSS vulnerabilities in Pivot 1.30 RC2 and earlier, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 fg, 2 line1, 3 line2, 4 bg, 5 c1, 6 c2, 7 c3, and 8 c4 parameters in a includes/blogroll.php; 9 name and 10...
Pivot 1.30 RC2 - Privilege Escalation / Remote Code Execution
!/usr/bin/php -q -d shortopentag=on ? echo "Pivot = 1.30 RC2 privileges escalation / remote commands execution exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dorks: "Powered byPivot"\n"; echo "version specific: "Powered byPivot - 1.30 RC2"...
JVN#44846612 ATutor cross-site scripting vulnerability
Impact An arbitrary script may be executed on the user's web browser. Authentication information could be stolen as a result. Solution Products Affected ATutor 1.5.3 RC2 and earlier...
ATutor 1.5.x - '/users/browse.php?cat' Cross-Site Scripting
source: https://www.securityfocus.com/bid/18857/info ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to have arbitrary script code execute ...
ATutor 1.5.x - adminfix_content.php?submit Cross-Site Scripting
ATutor 1.5.x - adminfixcontent.php?submit Cross-Site Scripting source: https://www.securityfocus.com/bid/18857/info ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...
CVE-2006-3272
Cross-site request forgery CSRF vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user, such as changing usernames and passwords, via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained from third...
CVE-2006-3272
CVE-2006-3272 describes a Cross-site request forgery (CSRF) in Some Chess 1.5 rc2 affecting the menu.php component. The vulnerability allows an attacker to perform actions as another user (e.g., changing usernames and passwords) via unspecified vectors. The available documents confirm the affecte...
CVE-2006-3254
Woltlab Burning Board (WBB) 2.0 RC2 contains a SQL injection in newthread.php that allows remote attackers to execute arbitrary SQL commands via the boardid parameter. The vulnerability is described in CVE-2006-3254; original sources confirm the affected component and impact, but do not provide a...
WBB<<---v2.0 RC2 "newthread.php" SQL Injection
======================================== Discovered By: CrAzY CrAcKeR Site:www.alshmokh.com I want to thank my friend:- nono225-mHOn-rageh-Lover Hacker-Breeeeh BoNym-Rootshill-LiNuXrOOt-Sw33t h4ck3r ======================================== Example:- /newthread.php?boardid=SQL...
IlohaMail Attachment Upload Vulnerability
The target is running at least one instance of IlohaMail version 0.7.9-RC2 or earlier. Such versions do not properly check the upload path for file attachments, which may allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use. Fo...
IlohaMail < 0.7.9 Attachment Upload Vulnerability
IlohaMail does not properly check the upload path for file attachments, which may allow an attacker to place a file on the target in a location writable by the web user if the file-based backend is in use. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted fro...
CVE-2005-3259
Multiple SQL injection vulnerabilities in versatileBulletinBoard vBB 1.0.0 RC2 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 login field, 2 "search this thread" feature, 3 "search for posts" feature, 4 "forgot password" feature, 5 list parameter in...
CVE-2005-2734
Cross-site scripting XSS vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag...
[SA16389] Gallery PostNuke Integration Security Issue
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
CVE-2001-1516
Affected software: phpReview, versions 0.9.0 rc2 and earlier. Vulnerability: Cross-site scripting (XSS) via user-submitted reviews, enabling remote attackers to inject arbitrary script/HTML. Root cause: inadequate input sanitization in the review submission pathway. Impact: not quantified beyond ...
FreeBSD : horde -- Horde Page Title XSS Vulnerability (396ee517-a607-11d9-ac72-000bdb1444a4)
Secunia Advisory: SA14730 A vulnerability has been reported in Horde, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed when setting the parent frame's page title via JavaScript is not properly sanitised before being returned to the user. This can be...
[Full-disclosure] Dokeos - Multiple Vulnerabilities
2 months ago we published an advisory about the Claroline application: http://www.zone-h.org/advisories/read/id=7472 Dokeos www.dokeos.com 1.5.5 has the same vulnerabilities than Claroline because it was based on it, but not all of them: there are 3 file inclusion vulnerabilities, and some of the...
