CVE-2007-3249

Cross-site scripting XSS vulnerability in modlettermansubscribe.php in the Letterman Subscriber modletterman before 1.2.5 module for Joomla! allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter...

CVE-2007-3249

CVE-2007-3249 is an XSS vulnerability in the Joomla! Letterman Subscriber module (mod_letterman) before version 1.2.5, triggered via the Itemid parameter in mod_lettermansubscribe.php. The connected documents confirm the affected component and vulnerability type, but do not provide concrete explo...

TISA2007-01.txt

========================================================================= TeamIntell Security Advisory TISA2007-01 ------------------------------------------------------------------------- Letterman Subscriber Module "Itemid" Script Insertion Vulnerability...

[Full-disclosure] Letterman subscriber module XSS vulnerability

========================================================================= TeamIntell Security Advisory TISA2007-01 ------------------------------------------------------------------------- Letterman Subscriber Module "Itemid" Script Insertion Vulnerability...

Joomla! Component Letterman Subscriber Module 1.2.4 - Mod_Lettermansubscribe.php Cross-Site Scripting

Joomla! Component Letterman Subscriber Module 1.2.4 - ModLettermansubscribe.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24479/info The Joomla! Letterman Subscriber module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize...

Joomla! Component Letterman Subscriber Module 1.2.4 - 'Mod_Lettermansubscribe.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24479/info The Joomla! Letterman Subscriber module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser...

fizzle-access.txt

Fizzle allows feeds to use HTML in feed data resulting in JavaScript being run in the chrome: window with chrome permissions. The extension will convert HTML entities back to their ASCII equivalents thus for formatting to lose their layout I told him it would be too difficult to sanitize the data...

PHP Subscriber远程密码泄露漏洞

PHP Subscriber是一款基于PHP的WEB应用程序。 PHP Subscriber不正确过滤用户提交的输入，远程攻击者可以利用漏洞获得密码敏感信息。 攻击者可以请求http://www.site.com/path/pwd.txt连接获得密码文件信息，然后使用BASE64解码密码信息。 PHP Subscriber 目前没有详细漏洞细节提供...

CVE-2007-0518

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

Improper access control

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0518

Scriptsez Smart PHP Subscriber aka subscribe stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt...

CVE-2007-0518

The CVE-2007-0518 entry concerns Scriptsez Smart PHP Subscriber (aka subscribe). The affected component stores sensitive information under the web root with insufficient access control, enabling remote attackers to retrieve encoded passwords via a direct request for pwd.txt. According to the NVD ...

subscribe (pwd.txt) Remote Password Disclosur

subscribe pwd.txt Remote Password Disclosur D0rk = "Powered By PHP Subscriber" discovered by : ThE TiGeR 100 Exploit : http://www.site.com/path/pwd.txt or http://www.site.com/pwd.txt then crack the password with bass64 decode ,,the password is coded by base64 not hash Contact:[email protected]...

open NewsLetter 2.5 - Multiple Vulnerabilities (2)

!/usr/bin/php -q -d shortopentag=on \r\n"; echo "Thanks to rgod for the php code and Marty for the Love\r\n\r\n"; if $argc Related: None\r\n"; echo " |- Es: php ".$argv0." localhost /opnletter/ 1\r\n\r\n"; echo " 2 - Credential Retrieve\r\n"; echo " |- Related: None\r\n"; echo " |- Es: php...

Hacker attack and Defense of the PPPoE authentication and use-vulnerability and early warning-the black bar safety net

A Foreword In recent years, Internet data traffic has developed rapidly, broadband users showed explosive growth, the operators in the use of xDSL, LAN, HFC, wireless and other access methods at the same time, in order to build an operable, manageable and profitable broadband network, is very...

Re: Multiple vulnerabilities in Linux based Cisco products

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is Cisco PSIRT's response to the privilege escalation vulnerability independently announced by Adam Pointon of Assurance.com.au and Mathieu Pepin of Axen Consulting. We would like to thank both Adam and Mathieu for bringing this issue to our...

CVE-2005-4794

Cisco IP Phones 7902/7905/7912, ATA 186/188, Unity Express, ACNS, and Subscriber Edge Services Manager SESM allows remote attackers to cause a denial of service crash or instability via a compressed DNS packet with a label length byte with an incorrect offset...

Mailman Password Retrieval

The target is running version of the Mailman mailing list software that allows a list subscriber to retrieve the mailman password of any other subscriber by means of a specially crafted mail message to the server. That is, a message sent to $listname-request@$target containing the lines : passwor...

Mailman private.py true_path Function Traversal Arbitrary File Access

According to its version number, the remote installation of Mailman reportedly is affected by a directory traversal vulnerability in 'Cgi/private.py'. The flaw comes into play only on web servers that don't strip extraneous slashes from URLs, such as Apache 1.3.x, and allows a list subscriber,...

mailman -- generated passwords are poor quality

Florian Weimer wrote: Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password either by email or the web frontend. Knowledge of this password allows an attacker to gain access to the list archi...