CVE-2008-7143: Exposure of Sensitive Information to an Unauthorized Actor

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header...

CVE-2008-7082: Cross-Site Request Forgery (CSRF)

MyBB aka MyBulletinBoard 1.4.3 includes the sensitive mypostkey parameter in URLs to moderation.php with the 1 mergeposts, 2 split, and 3 deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery CSRF protection mechanism to hijack the...

CVE-2008-6983

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

Code injection

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2008-6983

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2008-6983

CVE-2008-6983 affects devalcms 1.4a: the file modules/tool/hitcounter.php allows remote code execution via the HTTP Referer header using the gv_folder_data parameter, demonstrated by modifying modules/tool/url2header.php. This indicates improper handling of user-controlled input in the vulnerable...

CVE-2008-6983: Improper Control of Generation of Code

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

sablog1. 6 CSRF vulnerability POC-vulnerability warning-the black bar safety net

sablog1. 6 CSRF vulnerability POC. This in my blog, The test is successful, the official download the latest version of the test is successful, but in Ozawa blog failure. The reason is his own modified source program, to determine the referer's. POC: Comments, web site address Enter:...

FreeBSD : drupal -- multiple vulnerabilities (be927298-6f97-11de-b444-001372fd0af2)

The Drupal Security Team reports : Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...

CVE-2009-2374

Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from 1 the HTTP referer header of external web sites that are visited from those links or 2 when...

Default credentials

Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from 1 the HTTP referer header of external web sites that are visited from those links or 2 when...

CVE-2009-2374

Affected software: Drupal 5.x (before 5.19) and 6.x (before 6.13). Vulnerability: information disclosure of usernames and passwords in links on pages that contain a sortable table during failed login attempts. This can leak credentials via the HTTP referer header for external sites or through the...

CVE-2009-2374: Undefined Security Weakness

Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from 1 the HTTP referer header of external web sites that are visited from those links or 2 when...

Claroline 'notfound.php' Cross-Site Scripting Vulnerability

The host is running Claroline and is prone to SQL Injection Vulnerability. OpenVAS Vulnerability Test $Id: gbclarolinexssvuln.nasl 4865 2016-12-28 16:16:43Z teissa $ Claroline 'notfound.php' Cross-Site Scripting Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2009 Greenbone Networks Gmb...

Cross site scripting

Cross-site scripting XSS vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header...

CVE-2009-1907

Cross-site scripting XSS vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header...

CVE-2009-1907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header...

Sql injection

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

CVE-2009-1842

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

CVE-2009-1842: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...