osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20343/info osCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attack...

Kietu.txt

------=Part5616971320.1159049290474 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Content-Disposition: inline :: Produit : Kietu :: Langage : PHP :: Description : Kietu? est un script =E9crit en PHP, qui requiert une base de donn=E9e mySQL...

CVE-2006-3585

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS 2.1 SR1 allow remote attackers to inject arbitrary web script or HTML via the 1 login parameter in admin/cms/index.php, 2 unspecified parameters in the "Supply news" page in formmail.php, 3 the URL in the "Site statistics" page, and...

CVE-2006-3585

Multiple cross-site scripting XSS vulnerabilities in Jetbox CMS 2.1 SR1 allow remote attackers to inject arbitrary web script or HTML via the 1 login parameter in admin/cms/index.php, 2 unspecified parameters in the "Supply news" page in formmail.php, 3 the URL in the "Site statistics" page, and...

CVE-2006-3950

SQL injection vulnerability in x-statistics.php in X-Scripts X-Statistics 1.20 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

CVE-2006-3950

CVE-2006-3950 describes an SQL injection in X-Scripts X-Statistics 1.20, triggered through the User-Agent HTTP header in x-statistics.php. The vulnerability allows remote attackers to execute arbitrary SQL commands. Affected product/version: X-Scripts X-Statistics 1.20 (component: x-statistics.ph...

CVE-2006-3950: Undefined Security Weakness

SQL injection vulnerability in x-statistics.php in X-Scripts X-Statistics 1.20 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

CVE-2006-3705: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln 1 DB21 for Statistics and 2 DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection...

AWStats migrate parameter command injection

Added: 05/11/2006 CVE: CVE-2006-2237 BID: 17844 OSVDB: 25284 Background AWStats is a web application for showing web, FTP, and mail server statistics. Problem AWStats uses the value of the migrate input parameter in a PERL open call without sufficient checks for invalid characters, allowing remot...

CVE-2006-2174

Multiple cross-site scripting XSS vulnerabilities in admin/serverdaystats.php in Virtual Hosting Control System VHCS allow remote attackers to inject arbitrary web script or HTML via the 1 day, 2 month, or 3 year parameter...

security flaw

Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 multiple vectors in H.248, and the 2 X.509if, 3 SRVLOC, 4 H.245, 5 AIM, and 6 general packet dissectors; and 7 the statistics counter...

DMCounter092b.txt

Script: DMCounter Version: 0.9.2-b Language: PHP Problem: Remote File Include Vendor: http://sourceforge.net/projects/dmcounter Discovered by: beford Description ============= Statistics software based on PHP which does not require any database support but just uses flat files. Daily + monthly...

DMCounter Remote File Include

Script: DMCounter Version: 0.9.2-b Language: PHP Problem: Remote File Include Vendor: http://sourceforge.net/projects/dmcounter Discovered by: beford xbefordx gmail com Description ============= Statistics software based on PHP which does not require any database support but just uses flat files...

Fedora Core 5 : ethereal-0.99.0-fc5.1 (2006-456)

Many security vulnerabilities have been fixed since the previous release. - The H.248 dissector could crash. Versions affected: 0.10.14. CVE: CVE-2006-1937 - The UMA dissector could go into an infinite loop. Versions affected: 0.10.12 - 0.10.14. CVE: CVE-2006-1933 - The X.509if dissector could...

CVE-2006-1937

Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 multiple vectors in H.248, and the 2 X.509if, 3 SRVLOC, 4 H.245, 5 AIM, and 6 general packet dissectors; and 7 the statistics counter...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 multiple vectors in H.248, and the 2 X.509if, 3 SRVLOC, 4 H.245, 5 AIM, and 6 general packet dissectors; and 7 the statistics counter...

CVE-2006-1937

Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 multiple vectors in H.248, and the 2 X.509if, 3 SRVLOC, 4 H.245, 5 AIM, and 6 general packet dissectors; and 7 the statistics counter...

PT-2006-2921 · Ethereal · Ethereal

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.10.x up to 0.10.14 Description: The issue affects multiple components, including H.248, X.509if, SRVLOC, H.245, AIM, and general packet dissectors, as well as the statistics counter. Remote attackers can cause a denial of...

Ethereal 0.99.0 Release Notes

Ethereal 0.99.0 Release Notes Table of Contents What is Ethereal? What's New Bug Fixes New and Updated Features New Protocol Support Updated Protocol Support New and Updated Capture File Support Getting Ethereal Microsoft Windows Sun Solaris Source Code Vendor-supplied Packages File Locations Kno...

ReloadCMS <= 1.2.5 Cross Site Scripting / Remote Code Execution Exploit

Exploit for unknown platform in category web applications ======================================================================= ReloadCMS nc target.host.com 80 GET /pathtoreloadcms/ HTTP/1.0 User-Agent:...