EUVD-2006-4049

Malware in sbrugna...

EUVD-2006-4565

Malware in sbrugna...

EUVD-2006-4570

Malware in sbrugna...

CVE-2006-4582

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4578

The Address Book 1.04e is affected by CVE-2006-4578 via export.php, which dumps MySQL contents and writes username and password hash information to a publicly accessible file. Root cause is the dump exposing credentials in publicly accessible storage, enabling remote attackers to obtain sensitive...

CVE-2006-4578

export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information...

CVE-2006-4580

The CVE concerns The Address Book 1.04e: register.php allows remote attackers to bypass the 'Allow User Self-Registration' setting by supplying mode=confirm, enabling creation of arbitrary users. This is a client-side/configuration abuse affecting user provisioning, with the root cause described ...

CVE-2006-4582: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4580: Undefined Security Weakness

register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm"...

CVE-2006-4575: Undefined Security Weakness

Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the 1 lastname, 2 firstname, 3 passwordOld, 4 passwordNew, 5 id, 6 language, 7 defaultLetter, 8 newuserPass, 9 newuserType, 10 newuserEmail parameters in a user.php; the 1...

CVE-2006-4581: Undefined Security Weakness

Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts...

CVE-2006-4576: Undefined Security Weakness

Cross-site scripting XSS vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer...

CVE-2006-4577: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the 1 email, 2 websites, and 3 groupAddName parameters in a save.php; the 4 errorMsg parameter in b index.php; and the 5 goTo and 6...

CVE-2006-4579: Undefined Security Weakness

Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. dot dot in the language parameter...

CVE-2006-4578: Undefined Security Weakness

export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information...

CVE-2006-4056: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the authentication process in katzlbt a The Address Book 1.04e and earlier and b The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password parameters. NOTE: portions of these details...