CVE-2006-6007

The CVE-2006-6007 issue affects WebEvents (Online Event Registration Template) 2.0 and earlier, specifically save_profile.asp. The underlying flaw allows remote attackers to change profiles, passwords, and other information for arbitrary users by altering the UserID parameter. This describes a us...

Debian DSA-958-1 : drupal - several vulnerabilities

Several security related problems have been discovered in drupal, a fully-featured content management/discussion engine. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3973 Several cross-site scripting vulnerabilities allow remote attackers ...

osDate 1.1.7 multiple vulnerabilities

/ osDate 1.1.7 advisory / Date of written Advisory: ------------------------- July, 18 2006 Product: -------- OSdate = 1.1.7 Vendor: ------- http://tufat.com/ Description: ------------ osDate is a full fledged dating script which can be eaily integrated with phpBB and flashChat, and provides...

PassMasterFlex (and PassMasterFlex+) XSS injection

PassMasterFlex and PassMasterFlex+ XSS injection Discovered by: Nomenumbra Date: 5/4/2006 impact:moderate privilege escalation,possible defacement PassMasterFlex+ is a database-driven multiple login that utilizes cookies for authentication. PassMasterFlex+ was written not only to provide an...

[Full-disclosure] BetaBoard Cross Site Scripting vulnerability

//----- Advisory Program : BetaBoard Homepage : http://gonzo.uni-weimar.de/scheffl2/betaboard/ Tested version : 0.1 Found by : Simon MOREL philemon at thehackademy dot net This advisory : Simon MOREL philemon at thehackademy dot net Discovery date : 2006/04/16 //----- Application description...

CVE-2005-3974: Undefined Security Weakness

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission...

DRUPAL-SA-2005-009 Bypass "view user profiles" permission

Andrew Widdowson informed us that it's possible to bypass the 'access user profile' permission if the server is running PHP5. No data can be changed though. Versions affected Drupal 4.6.0, 4.6.1, 4.6.2, 4.6.3 Solution If you are running Drupal 4.6.x and PHP5, then upgrade to Drupal 4.6.4...

Hosting Controller 6.1 - User Profile Unauthorized Access

source: https://www.securityfocus.com/bid/13816/info Hosting Controller is prone to an unauthorized access vulnerability. Reportedly an authenticated user can modify other user's profiles. This issue is due to a failure in the application to perform proper authentication before providing access t...

CVE-2005-0899

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...

CVE-2005-0899

CVE-2005-0899 affects AS/400 OS/400 5.2 where LDAP is installed and enabled by default. The vulnerability allows remote authenticated users to obtain OS/400 user profiles by performing a search, indicating a potential information disclosure risk. The available documents do not specify a patch or ...

CVE-2005-0899

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search...

Npds BB HTML Injection

I release it very quickly ... So it can be improved : Code to put in a reply or in a topic : Your fake message/td/trtrtd valign="bottom"hr noshade size="1" class="ONGL" &nbspa href="user.php?op=userinfo&uname=User" CLASS="NOIR" target=blankimg src="images/forum/icons/profile.gif" border=0...