TikiWiki 2.2 XSS Vulnerability in URI

Application: TikiWiki Version: 2.2 latest Website: www.tikiwiki.org Bug: Active XSS in URI Exploitation: Remote Date: 12 Mar 2009 Discovered by: iliz Author: iliz Contact: e-mail: iliz-zatyandexdotru Bug Description: TikiWiki version 2.2 and later uses URI in html response body and fails to...

OneOrZero Helpdesk 'login.php' Local File Include Vulnerability

OneOrZero Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks. OneOrZero...

TinX CMS < 3.5.1 SQLi Vulnerability - Active Check

TinX CMS is prone to an SQL injection SQLi vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Wili-CMS remote and local File Inclusion and Authentication Bypass

Wili-CMS is prone to a remote and local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the application and the underlying computer; other attacks are also possible. Wili-CMS is also prone to a...

vBulletin 'admincalendar.php' SQL Injection Vulnerability

vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlyin...

PHORTAIL 1.2.1 - poster.php Multiple HTML Injection Vulnerabilities

PHORTAIL 1.2.1 - poster.php Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/34038/info PHORTAIL is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run i...

RitsBlog SQL Injection and HTML Injection Vulnerabilities

RitsBlog is prone to multiple HTML-injection vulnerabilities and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context ...

Afian 'includer.php' Directory Traversal Vulnerability

Afian is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions...

Apple Safari URI NULL Pointer Dereference DoS Vulnerability - Windows

Apple Safari web browser is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CMSCart 1.04 - maindatafunctions.php SQL Injection

CMSCart 1.04 - maindatafunctions.php SQL Injection source: https://www.securityfocus.com/bid/34017/info CMSCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Magento 1.2 - appcodecoreMageAdminhtmlcontrollersIndexController.php?email Cross-Site Scripting

Magento 1.2 - appcodecoreMageAdminhtmlcontrollersIndexController.php?email Cross-Site Scripting source: https://www.securityfocus.com/bid/33872/info Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied...

Magento 1.2 - 'downloader/index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33872/info Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the...

Magento 1.2 - '/app/code/core/Mage/Admin/Model/Session.php?login['Username']' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33872/info Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the...

Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection

source: https://www.securityfocus.com/bid/33859/info The gigCalendar component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...

imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability

SecurityFocus reports: University of Washington IMAP c-client is prone to a remote format-string vulnerability because the software fails to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function...

Clipbucket 1.7 - dwnld.php Directory Traversal

Clipbucket 1.7 - dwnld.php Directory Traversal source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive...

Clipbucket 1.7 - 'dwnld.php' Directory Traversal

source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks...

FotoWeb 6.0 - 'Grid.fwx?search' Cross-Site Scripting

source: https://www.securityfocus.com/bid/33677/info FotoWeb is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the...

FotoWeb 6.0 - Login.fwx?s Cross-Site Scripting

FotoWeb 6.0 - Login.fwx?s Cross-Site Scripting source: https://www.securityfocus.com/bid/33677/info FotoWeb is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context ...

Barracuda Load Balancer - realm Cross-Site Scripting

Barracuda Load Balancer - realm Cross-Site Scripting source: https://www.securityfocus.com/bid/33779/info Barracuda Load Balancer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary...