Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to perform unspecified restricted actions in the context of certain accounts by bypassing the client-side protection scheme...

CVE-2007-1332

Multiple cross-site request forgery CSRF vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to perform unspecified restricted actions in the context of certain accounts by bypassing the client-side protection scheme...

CVE-2007-1331

Multiple cross-site scripting XSS vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script or HTML via unspecified vectors that bypass the client-side protection scheme, one of which may be the q parameter to the search program. NOTE: some...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script or HTML via unspecified vectors that bypass the client-side protection scheme, one of which may be the q parameter to the search program. NOTE: some...

CVE-2007-1332

CVE-2007-1332 describes multiple cross-site request forgery (CSRF) vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java . Attackers can perform unspecified restricted actions in the context of affected accounts by bypassing the client-side protection scheme. The entry notes a high impact ...

CVE-2007-1331

CVE-2007-1331 affects TKS Banking Solutions ePortfolio 1.0 Java with multiple cross-site scripting (XSS) vulnerabilities. The description references arbitrary web script/HTML injection via unspecified vectors, one potential vector being the q parameter to the search program, allowing remote attac...

CVE-2007-1331

Multiple cross-site scripting XSS vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script or HTML via unspecified vectors that bypass the client-side protection scheme, one of which may be the q parameter to the search program. NOTE: some...

CVE-2007-1332

Multiple cross-site request forgery CSRF vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to perform unspecified restricted actions in the context of certain accounts by bypassing the client-side protection scheme...

CVE-2007-1332: Undefined Security Weakness

Multiple cross-site request forgery CSRF vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to perform unspecified restricted actions in the context of certain accounts by bypassing the client-side protection scheme...

CVE-2007-1331: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script or HTML via unspecified vectors that bypass the client-side protection scheme, one of which may be the q parameter to the search program. NOTE: some...

ePortfolio version 1.0 Java Multiple Input Validation Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ePortfolio version 1.0 Java Multiple Input Validation Vulnerabilities scip AG Vulnerability ID 2893 12/22/2006 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2893 I. INTRODUCTION ePortfolio is a e-banking application by TKS Banking Solutions. More...

CVE-2006-6998

install/loaderhelp.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERYSTRING, which calls the phpinfo function...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2006-6998

CVE-2006-6998 affects Headstart Solutions DeskPRO. The vulnerable file is install/loader_help.php, which can be accessed with a q=phpinfo QUERY_STRING to trigger phpinfo, allowing remote attackers to obtain configuration information. Documented impact is Partial Confidentiality with no integrity/...

CVE-2006-7000: Undefined Security Weakness

Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to 1 email/mail.php, 2 includes/init.php, 3 certain files in includes/cron/, and 4 jpgraph.php, 5 jpgraphbar.php, 6 jpgraphpie.php, and 7 jpgraphpie3d.php in includes/graph/, which leaks the path in...

CVE-2006-6974

The CVE-2006-6974 entry concerns Headstart Solutions DeskPRO, where sensitive data is stored under the web root with insufficient access control. According to the sources, an attacker can directly request various files in includes/ (config.php, config.php.bak, and other includes/), read files in ...

CVE-2006-6973: Undefined Security Weakness

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to 1 reinstall the application via a direct request for install/index.php; 2 delete the database via a do=deletedatabase QUERYSTRI...

CVE-2006-6974: Undefined Security Weakness

Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 list files in the includes/ directory; obtain the SQL username and password via a direct request for 2 config.php and 3 config.php.bak in includes/; rea...

Immunity Canvas: FLIP_INCLUDE

Name| flipinclude ---|--- CVE| CVE-2007-0785 Exploit Pack| CANVAS Description| Flip 2.01 = Remote File Include Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: Small Axe Solutions CVE Url: https://vulners.com/cve/CVE-2007-0785 CVE Name: CVE-2007-0785...

Flip 2.01 final - previewtheme.php?inc_path Remote File Inclusion

Flip 2.01 final - previewtheme.php?incpath Remote File Inclusion Flip-2.01-final 1.0 = Remote File Include Vulnerability Discovered by GolDMMahmnoodali & & Contact: [email protected] URL: http://releases.smallaxesolutions.com/flip-2.01.zip V.CODE: In : path/previewtheme.php include$incpath...