813 matches found
CVE-2008-3758: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier 1 allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the 2 Account picture...
CVE-2008-3760: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php...
vanilla-xss.txt
GulfTech Security Research August 19, 2008 Vendor : Mark O'Sullivan URL : http://www.getvanilla.com/ Version : Vanilla alert document.cookie%3B The above example link would display the end users cookie to them. Of course this can also be used to steal the cookie data as mentioned earlier in this...
Vanilla 1.1.4 - HTML Injection Cross-Site Scripting
Vanilla 1.1.4 - HTML Injection Cross-Site Scripting source: https://www.securityfocus.com/bid/30748/info Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these...
Vanilla <= 1.1.4 Script Injection/ XSS
GulfTech Security Research August 19, 2008 Vendor : Mark O'Sullivan URL : http://www.getvanilla.com/ Version : Vanilla = 1.1.4 Risk : Multiple Vulnerabilities Description: Vanilla is an open-source, standards-compliant, multi-lingual, fully extensible web based discussion forum. Unfortunately the...
Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting
source: https://www.securityfocus.com/bid/30748/info Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browse...
HP OpenView Network Node Manager 07.50 - CGI Remote Buffer Overflow
!/usr/bin/python HP OpenView Network Node Manager CGI Buffer Overflow Tested on NNM Release B.07.50 / Windows 2000 server SP4 http://www.zerodayinitiative.com/advisories/ZDI-07-071.html Coded by Mati Aharoni muts|offensive-security|com http://www.offensive-security.com/0day/hpnnm.txt Notes: Vanil...
Code injection
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for 1 ajax/sortcategories.php and 2 ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities...
CVE-2007-5644
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for 1 ajax/sortcategories.php and 2 ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities...
CVE-2007-5643
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the CategoryID parameter to ajax/sortcategories.php or 2 an unspecified vector to ajax/sortroles.php...
CVE-2007-5643
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the CategoryID parameter to ajax/sortcategories.php or 2 an unspecified vector to ajax/sortroles.php...
CVE-2007-5644
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for 1 ajax/sortcategories.php and 2 ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities...
CVE-2007-5643
CVE-2007-5643 describes multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier, allowing remote attackers to execute arbitrary SQL commands. The affected vectors are (1) the CategoryID parameter to ajax/sortcategories.php and (2) an unspecified vector to ajax/sortroles.php. T...
CVE-2007-5644
Lussumo Vanilla 1.1.3 and earlier allows remote unauthenticated users to perform unauthorized operations through two AJAX endpoints (ajax/sortcategories.php and ajax/sortroles.php) due to missing admin-privilege checks. Affected component: Vanilla CMS PHP backend; root cause: no authorization on ...
CVE-2007-5643: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the CategoryID parameter to ajax/sortcategories.php or 2 an unspecified vector to ajax/sortroles.php...
CVE-2007-5644: Undefined Security Weakness
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for 1 ajax/sortcategories.php and 2 ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities...
Vanilla Forum < 1.1.4 sortcategories.php CategoryID Parameter SQL Injection
Binary data 4258.prm...
Vanilla <= 1.1.3 Remote Blind SQL Injection Exploit
Exploit for unknown platform in category web applications =================================================== Vanilla = 4.1, magicquotesgpc=Off Tested on versions 1.1.3, 1.1.2, 1.0.1 echo "------------------------------------------------------------\n"; echo "Vanilla - use specific prefix default...
Vanilla <= 1.1.3 Remote Blind SQL Injection Exploit
No description provided by source. ?php Vanilla = 1.1.3 Remote Blind SQL Injection Exploit By InATeam http://inattack.ru/ Requirements: MySQL = 4.1, magicquotesgpc=Off Tested on versions 1.1.3, 1.1.2, 1.0.1 echo "------------------------------------------------------------\n"; echo "Vanilla = 1.1...
Vanilla 1.1.3 - Blind SQL Injection
Vanilla 1.1.3 - Blind SQL Injection = 4.1, magicquotesgpc=Off Tested on versions 1.1.3, 1.1.2, 1.0.1 echo "------------------------------------------------------------\n"; echo "Vanilla - use specific prefix default LUM\n"; echo "-id= - use specific user id default 1\n"; echo "-c= - benchmark's...