Fuju News 1.0 Authentication Bypass / Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================== Fuju News 1.0 Authentication Bypass / Remote SQL Injection Exploit ================================================================== Internet Security |...

php121im_14_sql_xpl.txt

!/usr/bin/php -q -d shortopentag=on works with magicquotesgpc = Off\r\n\r\n"; echo "a dork: inurl:php121login.php | inurl:php121im.php | intitle:"PHP121 - PLEASE"\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host: target server ip/hostname\r\n"; echo "path:...

CVE-2006-1095

Directory traversal vulnerability in the FileSession object in Modpython module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie...

Directory traversal

Directory traversal vulnerability in the FileSession object in Modpython module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie...

CVE-2006-1095

Directory traversal vulnerability in the FileSession object in Modpython module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie...

CVE-2006-1095

The CVE-2006-1095 entry applies to Apache’s mod_python (FileSession object) and 3.2.7, where a directory traversal via a crafted session cookie can allow local code execution. Affected component: mod_python 3.2.7 for Apache (FileSession). Root cause: directory traversal in session handling. Impac...

CVE-2006-1095

Directory traversal vulnerability in the FileSession object in Modpython module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie...

Geeklog lib-sessions.php Session Cookie Handling Administrative Bypass

Binary data 3464.prm...

CVE-2006-0704

iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...

CVE-2006-0704

iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...

CVE-2006-0411

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

HTTP login page

This script logs onto a web server through a login page and stores the authentication / session cookie. OpenVAS Vulnerability Test $Id: httplogin.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: HTTP login page Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is fre...

XOOPS < 2.0.12 Multiple Vulnerabilities

The installed version of XOOPS on the remote host is affected by several vulnerabilities : - A SQL Injection Vulnerability The bundled XMLRPC server fails to sanitize user- supplied input to the 'xmlrpc.php' script. An attacker can exploit this flaw to launch SQL injection attacks, which could le...

Bea Weblogic application server Server Console crossite scripting

Crossite scripting; no session cookie timeout is implemented...

SqWebMail redirect Parameter CRLF Injected XSS

The remote host is running a version of SqWebMail that does not properly sanitize user-supplied input through the 'redirect' parameter. An attacker can exploit this flaw to inject arbitrary HTML and script code into a user's browser to be executed within the context of the affected website. Such...

[Hackers Center Security Group] Sqwebmail Http Splitting Vulnerability

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: Http Splitting leads to email account stealing Product: SQWebmail Risk: High A dangerous http splitting attack can be taken against mailboxes that use Sqwebmail as web mail interface. Anyone can send a...

Horde Nag common-footer.inc Parent Frame Page Title XSS

According to its version, the remote installation of Nag fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...

IMP common-footer.inc Parent Frame Page Title XSS

According to its version, the remote installation of IMP fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...

Magic Winmail Server 4.0 (Build 1112) - download.php Traversal Arbitrary File Access

Magic Winmail Server 4.0 Build 1112 - download.php Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface...

ubbXSS.txt

Vendor: Infopop URL: http://www.infopop.com/ tested Versions: 6.2.3 & 6.5 remote: yes vendor notified: 06 Dec 2004 at 01:08 AM Vendor response: 06/07 Dec 2004 01:33 AM/06:08 PM Update status: ..in process ============================================================ Summary: UBBThreads is a High e...