CVE-2007-5990

Cross-site scripting XSS vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a user profile, possibly the 1 name and 2 website parameters to register.php...

CVE-2007-5990

Cross-site scripting XSS vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a user profile, possibly the 1 name and 2 website parameters to register.php...

exophpdesk-sql.txt

ExoPHPdesk user profile XSS / profile SQL injection http://exoscripts.com/exohelpdesk You can inject script code into the website area where you create profile. Cookies are in place making an XSS more than possible. http://example.com/helpdesk/index.php?fn=profile&s=&user=admin' sql here SQL...

ExoPHPdesk user profile XSS / profile SQL injection

ExoPHPdesk user profile XSS / profile SQL injection http://exoscripts.com/exohelpdesk You can inject script code into the website area where you create profile. Cookies are in place making an XSS more than possible. http://example.com/helpdesk/index.php?fn=profile&s=&user=admin' sql here SQL...

HTML Injection Vuln in nssboard

Nssboard, formerly Simple PHP forum, is vulnerable to HTML injection including scripts possible XSS in two ways: 1. If BBcode is disabled, HTML tags are no longer stripped, allowing XSS attacks, etc. 2. Profile information user, email, Real Name is not filtered. For example a user could use...

CVE-2007-4912

Cross-site scripting XSS vulnerability in ipskernel/classajax.php in Invision Power Board IPB or IP.Board 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8...

Code injection

Unspecified vulnerability in sources/actionpublic/xmlout.php in Invision Power Board IPB or IP.Board 2.2.0 through 2.2.2 allows remote attackers to modify another user's profile data, such as an AIM screen name or Yahoo! identity...

otscms-multi.txt

Coding 4 Fun Name = OTSCMS 2.1.5 by Wrzasq http://otscms.com ; Class = Sql Injection / XSS ; Download = http://sourceforge.net/project/showfiles.php?groupid=145557 ; Found by = GregStar gregstaratc4f.pl http://c4f.pl ;...

Design/Logic Flaw

index2.php in ACGVannu 1.3 and earlier allows remote attackers to change the password or profile of a user via a modified id parameter, related to templates/modif.html. NOTE: some of these details are obtained from third party information...

Design/Logic Flaw

Microsoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a previous system user, possibly related to user profile unload failure. NOTE: it is not clear whether this is an issue in Windows itself, or an interaction wit...

CVE-2007-0351

Microsoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a previous system user, possibly related to user profile unload failure. NOTE: it is not clear whether this is an issue in Windows itself, or an interaction wit...

[SA23619] Novell Client User Profile Restriction Bypass

TITLE: Novell Client User Profile Restriction Bypass SECUNIA ADVISORY ID: SA23619 VERIFY ADVISORY: http://secunia.com/advisories/23619/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network SOFTWARE: Novell Client for Windows NT/2000/XP 4.x http://secunia.com/product/1516/...

Novell Client TS/Citrix Session Arbitrary User Profile Invocation

The file 'nwgina.dll' included with the Novell Client software reportedly fails to delete user profiles when in a Terminal Server / Citrix session. A local user may be able to leverage this issue to invoke other user profiles on the affected host. C Tenable Network Security, Inc...

Enthrallweb eNews 1.0 - Remote User Pass Change

User Id: PASSWORD: FIRST: LAST: tr valign="baseline...

Seditio Users.Profile.Inc.PHP SQL 注入漏洞

Seditio是一款基于PHP的WEB应用程序。 Seditio不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行sql注入攻击，获得敏感信息。 问题是由于'Users.Profile.Inc.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意sql查询作为参数数据，可更改原来的sql逻辑，获得敏感信息。 Neocrome Seditio 1.10 目前没有解决方案提供： http://www.neocrome.net/page.php?al=seditio...

CVE-2006-5830

Multiple cross-site scripting XSS vulnerabilities in All In One Control Panel AIOCP 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topid, 2 forid, and 3 catid parameters to code/cpforumview.php; 4 choosedlanguage parameter to cpdpage.php; 5 orderdir...

CVE-2006-5830

Multiple cross-site scripting XSS vulnerabilities in All In One Control Panel AIOCP 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topid, 2 forid, and 3 catid parameters to code/cpforumview.php; 4 choosedlanguage parameter to cpdpage.php; 5 orderdir...

PT-2006-5265 · Microsoft · Terminal Server

Name of the Vulnerable Software and Affected Versions: Microsoft Terminal Server affected versions not specified Description: The issue allows local users to execute arbitrary code by forcing an Explorer error when running an application session with specific options. These options, "Start progra...

CVE-2006-3443

Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4, when SafeDllSearchMode is disabled, allows local users to gain privileges via a malicious DLL in the UserProfile directory, aka "User Profile Elevation of Privilege Vulnerability."...

CVE-2006-3443

CVE-2006-3443 affects Windows 2000 SP4 with Winlogon vulnerable to a User Profile Elevation of Privilege when SafeDllSearchMode is disabled. A local attacker can place a malicious DLL in the UserProfile directory to execute code with SYSTEM-level privileges after logon, as described in Microsoft ...