CVE-2005-2219

CVE-2005-2219 affects Hosting Controller 6.1 Hotfix 2.1. Remote authenticated users can perform unauthorized actions by sending a direct request to AccountActions.asp and modifying the CreditLimit parameter in the UpdateCreditLimit action, enabling changes to user credit limits. The linked Red Ha...

Same-origin violation with InstallTrigger callback — Mozilla

The InstallTrigger.install method for launching an install accepts a callback function that will be called with the final success or error status. By forcing a page navigation immediately after calling the install method this callback function can end up running in the context of the new page...

CVE-2002-1821

Affected software: Ultimate PHP Board (UPB) 1.0 and 1.0b. Vulnerability: Remote authenticated users can gain privileges and perform unauthorized actions by making direct requests to specific admin pages: admin_members.php, admin_config.php, admin_cat.php, and admin_forum.php. Root cause/impact: T...

CVE-2002-1821

Ultimate PHP Board UPB 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to 1 adminmembers.php, 2 adminconfig.php, 3 admincat.php, or 4 adminforum.php...

Community Server Forums - SearchResults.aspx Cross-Site Scripting

Community Server Forums - SearchResults.aspx Cross-Site Scripting source: https://www.securityfocus.com/bid/14078/info Community Server Forums is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker...

Community Server Forums - 'SearchResults.aspx' Cross-Site Scripting

source: https://www.securityfocus.com/bid/14078/info Community Server Forums is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may exploit these issues to execute arbitrary script code in the...

CVE-2005-1475

The CVE-2005-1475 issue affects Opera 8.0 Final Build 1095 where the XMLHttpRequest object could bypass same-origin restrictions due to insufficient validation of server-side redirects, allowing a remote attacker to access resources on other domains and perform actions with the user’s privileges....

CVE-2003-1212

MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...

CVE-2003-1212

MaxWebPortal 1.30 is affected. The vulnerability allows remote attackers to perform unauthorized actions by tampering with hidden form fields (examples: news, lock, allmem) on the 'start new topic' HTML page. Root cause is modification of hidden fields, enabling unauthorized actions. The availabl...

CVE-2005-0535

Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...

CVE-2005-0535

Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...

CVE-2005-0535

MediaWiki is affected by a CSRF vulnerability (CVE-2005-0535) in 1.3.x prior to 1.3.11 and 1.4 beta prior to 1.4 RC1, allowing remote attackers to perform actions as authenticated users. The issue is documented across multiple sources (NVD entry, Gentoo GLSA-200502-33, and related advisories), wi...

CVE-2005-0535

Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...

CVE-2005-0535

Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...

DEBIAN-CVE-2005-0535

Cross-site request forgery CSRF vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users...

CVE-2004-2403

Cross-site request forgery CSRF vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters...

IWebNegar - Multiple SQL Injections

source: https://www.securityfocus.com/bid/11946/info iWebNegar is reported prone to multiple SQL injection vulnerabilities, these issues exist due to a lack of sufficient boundary checks performed on user-supplied URI parameter data. These issues could theoretically be exploited to compromise the...

CVE-2004-0494

Multiple extfs backend scripts for GNOME virtual file system VFS before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI...

CVE-2004-0494

Multiple extfs backend scripts for GNOME virtual file system VFS before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI...

DEBIAN-CVE-2004-0274

Share.mod in Eggheads Eggdrop IRC bot 1.6.10 through 1.6.15 can mistakenly assign STATOFFERED status to a bot that is not a sharebot, which allows remote attackers to use STATOFFERED to promote a bot to a sharebot and conduct unauthorized activities...