SAP BusinessObjects 12 - URI redirection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary script or HTML code,...

PHPMySpace Gold 'gid' Parameter SQL Injection Vulnerability

PHPMySpace Gold is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

boastMachine Arbitrary File Upload Vulnerability

boastMachine is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

irc-ratbox -- multiple vulnerabilities

SecurityFocus reports: The first affects the /quote HELP module and allows a user to trigger an IRCD crash on some platforms. The second affects the /links processing module when the flattenlinks configuration option is not enabled...

Zope XSS Vulnerability (Jan 2010)

Zope is prone to a cross-site scripting XSS vulnerability because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

SiteX 'THEME_FOLDER' Parameter Multiple Local File Include Vulnerabilities

SiteX is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the...

DataLife Engine 8.3 - engineajaxpm.php?config[lang] Remote File Inclusion

DataLife Engine 8.3 - engineajaxpm.php?configlang Remote File Inclusion source: https://www.securityfocus.com/bid/37851/info Datalife Engine is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an...

Bits Video Script 2.05 Gold Beta - 'showcase2search.php?rowptem[template]' Remote File Inclusion

source: https://www.securityfocus.com/bid/40709/info Bits Video Script is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute...

SystemTap 1.0 - stat-server Arbitrary Command Injection

SystemTap 1.0 - stat-server Arbitrary Command Injection source: https://www.securityfocus.com/bid/37842/info SystemTap is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. Remote attackers can exploit this issue to execute arbitrar...

Boa Webserver Terminal Escape Sequence in Logs Command Injection Vulnerability

Boa Webserver is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Orion Application Server Terminal Escape Sequence in Logs Command Injection Vulnerability

Orion Application Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective righ...

JpGraph <= 3.0.6 Multiple XSS Vulnerabilities

JpGraph is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Ruby WEBrick Terminal Escape Sequence in Logs Command Injection Vulnerability

Ruby WEBrick is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Layout CMS 1.0 SQL-Injection and Cross-Site Scripting Vulnerabilities

Layout CMS 1.0 SQL-Injection and Cross-Site Scripting Vulnerabilities. Webapps exploit for php platform source: http://www.securityfocus.com/bid/40415/info Layout CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize...

2^6 TCP Control Bit - Fuzzer (No ECN or CWR)

2^6 TCP Control Bit - Fuzzer No ECN or CWR !/usr/bin/perl 2^6 TCP Control Bit Fuzzer No ECN or CWR This code was written originally as a control bit fuzzer for the JunOS 3-9 crash mentioned in PSN-2010-01-623 and http://www.securityfocus.com/news/11571 However it will also be useful in fuzzing...

Yaws 1.55 - 'Logs' Terminal Escape Sequence Command Injection

source: https://www.securityfocus.com/bid/37716/info Yaws is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal. Yaws 1.85 is vulnerable; other versions ma...

Smart Statistics 1.0 - 'smart_Statistics_admin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40468/info Smart Statistics is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

dotProject 2.1.3 - Multiple SQL Injections HTML Injection Vulnerabilities

dotProject 2.1.3 - Multiple SQL Injections HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/37669/info dotProject is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage t...

Joomla! Component DM Orders - id SQL Injection

Joomla! Component DM Orders - id SQL Injection source: https://www.securityfocus.com/bid/37655/info The DM Orders component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue...

Snitz Forums 2000 'X-Forwarded-For' SQL Injection Vulnerability

Snitz Forums 2000 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...