Serendipity serendipity_event_bbcode.php Script serendipity[charset] Parameter Local File Inclusion

The 'plugins/serendipityeventbbcode/serendipityeventbbcode.php' script included with the version of Serendipity installed on the remote host fails to sanitize input to the 'serendipitycharset' parameter before using it to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an...

Serendipity serendipity[charset] Parameter Local File Inclusion

Binary data 3835.prm...

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL...

S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion

DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patriots : - Leito & Leon | friend str0ke ; pepi,...

Serendipity <= 1.0.3 (comment.php) Local File Include Exploit

Exploit for unknown platform in category web applications ============================================================= Serendipity = 1.0.3 comment.php Local File Include Exploit ============================================================= ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :...

CVE-2006-5499

Multiple cross-site scripting XSS vulnerabilities in Serendipity s9y 1.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the media manager administration page...

CVE-2006-5499

Multiple cross-site scripting XSS vulnerabilities in Serendipity s9y 1.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the media manager administration page...

CVE-2006-5499

Serendipity (s9y) 1.0.1 and earlier are affected by multiple XSS vulnerabilities in the media manager administration page. The flaws allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. No exploits or remediation details are provided in the documents; affected ve...

FreeBSD : Serendipity -- XSS Vulnerabilities (96ed277b-60e0-11db-ad2d-0016179b2dd5)

The Serendipity Team reports : Serendipity failed to correctly sanitize user input on the media manager administration page. The content of GET variables were written into JavaScript strings. By using standard string evasion techniques it was possible to execute arbitrary JavaScript. Additionally...

Advisory 11/2006: Serendipity Weblog XSS Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Serendipity Weblog XSS Vulnerabilities Release Date: 2006/10/19 Last Modified: 2006/10/19 Author: Stefan Esser sesser at hardened-php dot net email concealed Application:...

php -- _ecalloc Integer Overflow Vulnerability

Stefan Esser reports: The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch. It was discovered that such an integer overflo...

CVE-2006-2495

Cross-site request forgery CSRF vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag...

CVE-2006-2495

CVE-2006-2495 describes a CSRF vulnerability in the Serendipity project’s Entry Manager prior to version 1.0-beta3 . The issue allows remote attackers to perform unauthorized actions on behalf of a logged-in user by enticing them to click a link or view an image tag. The underlying risk is cross-...

CVE-2006-2495

Cross-site request forgery CSRF vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag...

[SA20155] Serendipity Entry Manager Cross-Site Request Forgery

TITLE: Serendipity Entry Manager Cross-Site Request Forgery SECUNIA ADVISORY ID: SA20155 VERIFY ADVISORY: http://secunia.com/advisories/20155/ CRITICAL: Less critical IMPACT: Hijacking WHERE: From remote SOFTWARE: Serendipity 0.x http://secunia.com/product/3969/ DESCRIPTION: A vulnerability has...

Information disclosure

config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1910

config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-1910

This CVE affects S9Y Serendipity 1.0 beta 2, where config.php values stored by the application can be edited to inject and later execute arbitrary PHP code. The underlying issue is PHP code execution triggered by manipulated config.php content, enabling remote code execution with likely impact to...

CVE-2006-1910

config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...