CVE-2008-6776

CVE-2008-6776 affects Scripts For Sites (SFS) EZ Hot or Not, specifically the viewcomments.php component. The issue is a SQL injection via the phid parameter, enabling remote attackers to execute arbitrary SQL commands. The vulnerability is documented across multiple feeds (NVD and related listin...

CVE-2008-6784

CVE-2008-6784 is a SQL injection vulnerability affecting directory.php in Scripts For Sites (SFS) EZ Adult Directory. The vulnerable parameter is cat_id in a list action, enabling remote attackers to execute arbitrary SQL commands. The connected documents confirm the issue and provide references,...

CVE-2008-6776

SQL injection vulnerability in viewcomments.php in Scripts For Sites SFS EZ Hot or Not allows remote attackers to execute arbitrary SQL commands via the phid parameter...

CVE-2008-6784

SQL injection vulnerability in directory.php in Scripts For Sites SFS EZ Adult Directory allows remote attackers to execute arbitrary SQL commands via the catid parameter in a list action...

CVE-2008-6780

The CVE-2008-6780 entry describes an SQL injection vulnerability in directory.php of Scripts for Sites (SFS) EZ Affiliate. The issue allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. No version-specific details are provided in the documents. Publ...

Update Protection against Oracle Application Server BPEL Module Cross Site Scripting

Oracle Application Server is vulnerable to cross-site scripting due to lack of validation of user supplied data. Oracle Application Server is a multi-platform solution for developing and deploying enterprise applications and web sites. The flaw may be exploited by attackers to execute arbitrary...

ECShop 2.5.0 (order_sn) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== ECShop 2.5.0 ordersn Remote SQL Injection Vulnerability ==========================================================...

Update Protection against Oracle Application Server 10g OPMN Service Format String Vulnerability

A vulnerability was reported in Oracle Application Server, a multi-platform solution for developing and deploying enterprise applications and web sites. The flaw is due to insufficient validation of the URI part of HTTP requests. Remote attackers could exploit this vulnerability by sending a...

Cybergangs use cheap labor to break codes on social sites

From USA Today Byron Acohido It’s become the new front in cybercrime: scams and identity-theft programs that attack e-mail accounts and users of social-networking sites such as Facebook and MySpace. To carry out many of these automated attacks, cybercriminals first must overcome “captchas,” the...

Mozilla Foundation Security Advisory 2009-20

Mozilla Foundation Security Advisory 2009-20 Title: Malicious search plugins can inject code into arbitrary sites Impact: Low Announced: April 21, 2009 Reporter: Prateek Saxena Products: Firefox Fixed in: Firefox 3.0.9 Description Security researcher Prateek Saxena reported that a malicious...

85% of malicious sites only online for 24 hours

From PC Advisor Carrie-Ann Skinner More than 80 percent of websites that had been poisoned with malicious code between 2008 and 2009 were removed within 24 hours, says AVG. The security vendor’s Web Threat Profile Report estimated that on any one day between 8 and 14 million web users are being...

Job2C 4.2 (profile) Remote Shell Upload Vulnerability

No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...

phpDatingClub (conf.inc) File Disclosure Vulnerability

No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...

phpGreetCards (conf.inc) Config File Disclosure Vulnerability

No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...

phpAdBoardPro File Disclosure

|| || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

phpGreetCards - Config File Disclosure

phpGreetCards - Config File Disclosure || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

IBM WebSphere Application Server < 6.1.0.23 Multiple Flaws

IBM WebSphere Application Server 6.1 before Fix Pack 23 appears to be installed on the remote host. Such versions are reportedly affected by multiple vulnerabilities : - Provided an attacker has valid credentials, it may be possible to hijack an authenticated session. PK66676 - It may be possible...

Job2C 4.2 Shell Upload

|| || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

W2B phpEmployment File Disclosure

|| || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

Adgregate ShopAd widget validation is vulnerable to replay attack

Adgregate is a "TechCrunch 50" startup that recently signed a distribution deal with Google/DoubleClick 1. As a service, they offer a "viral widget" intended to be hosted on untrusted third-party sites through which consumers can enter their credit card information. According to their website, th...