2636 matches found
CVE-2005-2193
CVE-2005-2193 affects PunBB up to version 1.2.5, where the profile.php:temp parameter is not initialized/sanitized before being used in a database query, enabling remote SQL injection. The root cause is improper handling of the temp array, allowing attacker-controlled input to influence SQL state...
[SA15936] phpSlash "author_id" User Profile Manipulation Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
PunBB 1.x - 'profile.php' User Profile Edit Module SQL Injection
source: https://www.securityfocus.com/bid/14195/info PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module of the 'profile.php' script before using it in a SQL query...
PunBB 1.x - profile.php User Profile Edit Module SQL Injection
PunBB 1.x - profile.php User Profile Edit Module SQL Injection source: https://www.securityfocus.com/bid/14195/info PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module o...
CVE-2005-1811
Cross-site scripting XSS vulnerability in usercp.php for MyBulletinBoard MyBB allows remote attackers to inject arbitrary web script or HTML via the website field in a user profile...
CVE-2005-1811
Cross-site scripting XSS vulnerability in usercp.php for MyBulletinBoard MyBB allows remote attackers to inject arbitrary web script or HTML via the website field in a user profile...
MyBB 1.0 RC4 XSS Bug
Description: MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. MyBB has been designed with the end users in mind, you and your subscribers. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the...
Hosting Controller 6.1 - User Profile Unauthorized Access
Hosting Controller 6.1 - User Profile Unauthorized Access source: https://www.securityfocus.com/bid/13816/info Hosting Controller is prone to an unauthorized access vulnerability. Reportedly an authenticated user can modify other user's profiles. This issue is due to a failure in the application ...
Hosting Controller < 6.1 Hotfix 2.1 Multiple Vulnerabilities
According to its version number, the version of Hosting Controller on the remote host suffers from multiple vulnerabilities: - An authenticated user can modify another user's profile, even an admin's, recover his/her password, and then gain access to the affected application as that user. - An...
Hosting Controller <= 0.6.1 Unauthenticated User Registeration (3rd)
Exploit for unknown platform in category web applications ==================================================================== Hosting Controller Username : emailaddress : firstname : 0day.today 2018-03-09...
Hosting Controller 0.6.1 - User Registration (3)
Hosting Controller 0.6.1 - User Registration 3 Username : emailaddress : firstname : milw0rm.com 2005-05-27...
Hosting Controller <= 0.6.1 Unauthenticated User Registeration (3rd)
No description provided by source. !-- Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in "UserProfile.asp" that an authenticated user can change other's profiles. Why is it dangerous: a user can change other's email address and then...
Hosting Controller 0.6.1 - User Registration (3)
Username : emailaddress : firstname : milw0rm.com 2005-05-27...
CVE-2004-1926
Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to inject arbitrary code via the 1 Theme, 2 Country, 3 Real Name, or 4 Displayed time zone fields in a User Profile, or the 5 Name, 6 Description, 7 URL, or 8 Country fields in a Directory/Add Site operation...
CVE-2004-1926: Improper Control of Generation of Code
Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to inject arbitrary code via the 1 Theme, 2 Country, 3 Real Name, or 4 Displayed time zone fields in a User Profile, or the 5 Name, 6 Description, 7 URL, or 8 Country fields in a Directory/Add Site operation...
CVE-2005-1167
Musicmatch 10.00.2047 and earlier store log files in the Program Files directory instead of the user profile, which may allow local users to obtain sensitive information...
CVE-2005-0777
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via 1 the checktags function or 2 the editbio field in the user profile...
CVE-2005-0899: Undefined Security Weakness
AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...
CVE-2005-0777
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via 1 the checktags function or 2 the editbio field in the user profile...
CVE-2004-1716
CVE-2004-1716 is a cross-site scripting (XSS) vulnerability affecting PForum before 1.26 . The issue allows remote attackers to inject arbitrary web script or HTML through the IRC Server or AIM ID fields in the user profile. The connected documents confirm the affected component and vectors but d...