W-Agora 4.1.6 - a download_thread.php?thread Cross-Site Scripting

W-Agora 4.1.6 - a downloadthread.php?thread Cross-Site Scripting source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these...

[Full-Disclosure] Multiple vulnerabilities in w-agora forum

http://www.maxpatrol.com/mpadvisory.asp Title: Multiple vulnerabilities in w-agora forum Date: 28.09.04 Severity: Medium Application: w-agora 4.1.6a, http://www.w-agora/en/download.php Platform: PHP I. DESCRIPTION Multiple vulnerabilities were found in w-agora forum. A remote user can conduct SQL...

W-Agora 4.1.6 - a redir_url.php?key SQL Injection

W-Agora 4.1.6 - a redirurl.php?key SQL Injection source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to...

W-Agora 4.1.6 - a forgot_password.php?userid Cross-Site Scripting

W-Agora 4.1.6 - a forgotpassword.php?userid Cross-Site Scripting source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these...

W-Agora 4.1.6 - 'a download_thread.php?thread' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, a...

W-Agora 4.1.6a - 'login.php?loginuser' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, a...

W-Agora 4.1.6a - 'subscribe_thread.php' HTTP Response Splitting

source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, a...

W-Agora 4.1.6 - 'a redir_url.php?key' SQL Injection

source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, a...

DEBIAN-CVE-2003-0854

ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd...

W-Agora 4.1.5

============================= Security REPORT W-Agora 4.1.5 ============================= Product: W-Agora 4.1.5 maybe earlier Vulnerablities: information disclosure, path disclosure, arbitrary file-upload, OS command execution, cross site scripting Vuln.-Classes: Check out...

Bug in w-agora

======================= ==Shell Security Team== ======================= ============================== ====Advisory For W-agora====== ============================== - Product : w-agora - Tested version : version 4.1.5 - Website : http://www.w-agora.net - Discovery By Sonyy - Vendor Status: inform...

W-Agora 4.1.6 - modules.php?File Traversal Arbitrary File Access

W-Agora 4.1.6 - modules.php?File Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/6595/info A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input. An attacker can construct a...

W-Agora 4.1.6 - index.php?bn Traversal Arbitrary File Access

W-Agora 4.1.6 - index.php?bn Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/6595/info A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input. An attacker can construct a URL...

W-Agora 4.1.6 - 'modules.php?File' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/6595/info A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input. An attacker can construct a URL consisting of dot-dot-slash ../ character sequences to obtain...

W-Agora 4.1.6 - 'index.php?bn' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/6595/info A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input. An attacker can construct a URL consisting of dot-dot-slash ../ character sequences to obtain...

CVE-2002-2129

Cross-site scripting vulnerability XSS in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form...

CVE-2002-2128

editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...

W-Agora 4.1.6 - EditForm.php Cross-Site Scripting

W-Agora 4.1.6 - EditForm.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6464/info W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems. A problem with W-Agora may make cross-site scripting attacks possible. It has be...

W-Agora 4.1.6 - 'EditForm.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6464/info W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems. A problem with W-Agora may make cross-site scripting attacks possible. It has been reported that W-Agora has a vulnerability in th...

XSS and PHP include bug in W-Agora

I have found some bugs in W-Agora's forum configuration filesystem. In the page editform.php, an admin or root user can open any file, with the "PHP Include bug". A sample of the script: editform.php ?php the script gets the parameter "file", puts ".php" after this, and includes the file in the...