368 matches found
Stack overflow
Stack-based buffer overflow in Easy File Sharing EFS Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp...
CVE-2014-3791
CVE-2014-3791 affects Easy File Sharing Web Server (EFS) Web Server, with a stack-based buffer overflow in the SESSIONID cookie handling (UserID) in vfolder.ghp, enabling remote code execution. The Red Hat entry reiterates the same description for EFS Web Server 6.8. Exploitation details are not ...
CVE-2014-3791
Stack-based buffer overflow in Easy File Sharing EFS Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp...
UBUNTU-CVE-2013-5674
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...
CVE-2013-5674
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...
CVE-2013-5674
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...
CVE-2012-5919
Multiple cross-site scripting XSS vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 find or 2 replace fields to havalite/findReplace.php; 3 username parameter to havalite/havalogin.php, 4 the Edit Article module, or 5 havapost.ph...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 find or 2 replace fields to havalite/findReplace.php; 3 username parameter to havalite/havalogin.php, 4 the Edit Article module, or 5 havapost.ph...
Sql injection
SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter...
CVE-2011-5234
SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter...
ECShop 2.7.2 API 盲注漏洞
简要描述： 该漏洞已经过本人测试存在。在服务器关闭魔法引号的情况下可以盲注，不受ECShop内核过滤影响。这次不坑爹了 问题文件在/api/client/api.php 利用方法为POST 详细说明： /api/client/api.php 第7行 dispatch$POST; /api/client/includes/libapi.php 6 -10 行 $funcarr = array'GetDomain', 'UserLogin', 'AddCategory', 'AddBrand', 'AddGoods', 'GetCategory', 'GetBrand', 'GetGoods...
JE CMS 1.0.0 universal password to log in with the injection vulnerability-vulnerability warning-the black bar safety net
JE CMS = 1.0.0 program appeared two vulnerabilities, one in the login authentication can be using Universal password bypass. Another isSQL injectionvulnerabilities. 1. Bypass Authentication by SQL Injection Vulnerability //login validation vulnerability in administrator\login.php page, lines...
JE CMS 1.0.0 - Authentication Bypass
JE CMS 1.0.0 - Authentication Bypass ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | userLogin; userLogin function is in administrator\library\functions.php. in lines 129-139: if $userName == '' || $password == '' $errorMessage = JEMISMATCHUSERNAMEPASSWORD; else...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the 1 userId parameter to tvserver/server/user/setPermissions.jsp, 2 deptName parameter to...
CVE-2010-1338
SQL injection vulnerability in tsother.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action...
Sql injection
SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...
CVE-2009-2734
SQL injection vulnerability in the getemployee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter aka userid variable to dispatch.php...
Sql injection
SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board WBB3 allows remote attackers to execute arbitrary SQL commands via the userID parameter in the RGalleryUserGallery page to index.php, a different vector than CVE-2008-4627...
CVE-2009-1665
CVE-2009-1665 affects myaccount.php in Easy Scripts Answer and Question Script. The issue allows remote attackers to remove arbitrary user accounts by modifying the userid parameter without supplying additional fields. This indicates an input manipulation vulnerability in the account-management l...