CVE-2005-4709

The CVE concerns JBoss EJB 3.0 RC3. The popSubjectContext method in SecurityAssociation preserves threadPrincipal and threadCredential from a prior client after the session ends, enabling a remote attacker to assume the roles of that previous client on the same server thread. This is described as...

CVE-2005-4256

Cross-site scripting XSS vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forumtitle parameter. NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID. In addition, its accuracy is in...

CVE-2005-4256

CVE-2005-4256 describes a cross-site scripting (XSS) vulnerability in ASP-DEV XM Forum RC3, specifically in forum.asp where the forum_title parameter can inject arbitrary script/HTML. Affected item is XM Forum RC3 (forum.asp handling). The core issue is an XSS in the forum_title parameter, enabli...

CVE-2005-4256

Cross-site scripting XSS vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forumtitle parameter. NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID. In addition, its accuracy is in...

[SA17859] SAPID CMS Security Bypass Vulnerability

TITLE: SAPID CMS Security Bypass Vulnerability SECUNIA ADVISORY ID: SA17859 VERIFY ADVISORY: http://secunia.com/advisories/17859/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: SAPID CMS 1.x http://secunia.com/product/6323/ DESCRIPTION: A vulnerability has been...

PhpGroupWare index.php HTML Injection Vulnerabilities

PhpGroupWare is prone to HTML injection vulnerabilities through SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

postnukeSQL0760rc3.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PostNuke Non Critical SQL Injection and Include 0.760-RC3=x cXIb8O3.10 Author: cXIb8O3Maksymilian Arciemowicz Date: 2.4.2005 from securityreason.com TEAM - --- 0.Description --- PostNuke: The Phoenix Release 0.760-RC3=X PostNuke is an open source, ope...

CVE-2002-1829

OpenBB (Open Bulletin Board) 1.0.0 RC3 has a cross-site scripting vulnerability in codeparse.php that allows remote attackers to inject arbitrary script via (1) myhome.php, (2) an onerror attribute in an IMG tag (variant of CVE-2002-0330), or (3) a glow tag. The issue stems from insufficient inpu...

CVE-2002-1802

XSS vulnerability CVE-2002-1802 affects XOOPS 1.0 RC3. The flaw allows remote attackers to inject arbitrary script/HTML via Javascript in an IMG tag when submitting news, due to insufficient input sanitization in the news submission workflow. Impact is Cross‑Site Scripting; no exploit vectors or ...

CVE-2005-1699

CVE-2005-1699 : A directory traversal vulnerability exists in the Xanthia module’s pnadminapi.php (PostNuke 0.760-RC3). Remote administrators can read arbitrary files by supplying a .. (dot dot) in the skin parameter, enabling partial confidentiality impact. The provided documents do not specify ...

CVE-2005-1700

CVE-2005-1700 affects PostNuke 0.760-RC3 via the Xanthia module. The vulnerability is an SQL injection in pnadmin.php exploitable by the riga[0] parameter, allowing remote administrators to execute arbitrary SQL commands. Connected sources corroborate SQL injection in Xanthia/Messages areas and P...

CVE-2005-1049

Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...

CVE-2005-1049

Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...

CVE-2005-1008

CVE-2005-1008 is an XSS vulnerability in ASP-DEv XM Forum RC3, affecting posts.asp where a javascript: URL in an IMG tag can inject arbitrary script/HTML. The OpenVAS/Nessus entries corroborate a cross-site scripting issue in this XM Forum component. The connected documents do not provide specifi...

CVE-2005-0776

adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to manipulate other users' photos...

CVE-2005-0777

PhotoPost PHP 5.0 RC3 is affected by multiple XSS vulnerabilities. Specifically, remote attackers can inject arbitrary script or HTML via (1) the check_tags function and (2) the editbio field in the user profile. The issues arise from unsanitized input in these areas, enabling reflected or stored...

Fedora Core 2 : kernel-2.6.6-1.427 (2004-137)

An updated kernel is available that brings the kernel to the 2.6.7-rc3 base level. This new kernel provides a significant number of bug fixes and improvements for USB, the keyboard/mouse subsystem and the VM. This kernel also fixes the high profile bugs about not working on VIA C3 processors 1206...

[SCSA-024] BES-CMS including file vulnerability

====================================================================== Security Corporation Security Advisory SCSA-024 BES-CMS including file vulnerability ====================================================================== PROGRAM: BES-CMS HOMEPAGE: http://bes.h6p.org VULNERABLE VERSIONS: 0.4...

WebChat for XOOPS RC3 SQL INJECTION

Text available at http://www.phpsecure.org/tutos/webchat.1-5.xoops.rc3.sql.injection.txt Patch available on phpsecure.org XOOPS RC3 WebChat Module SQL Injection Tested with : Xoops RC3 WebChat 1-5 Author : val2 - phpsecure.org for more info and patchs Lines 291-299 from modules/WebChat/index.php ...

Security holes in OpenBB

Product : OpenBB http://www.prolixmedia.com Versions : 1.0.0 RC3 and less ? Problems : - XSS - Access to moderators' options Exploits : - /myhome.php?action=messages&box=form20name=ainput 20name=i20value=XSS/formscriptalert document.a.i.value/script - imghttp://" onerror="SCRIPT"/img - glow...