1341 matches found
CVE-2005-2113
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method...
XOOPS2011.txt
GulfTech Security Research June 28th, 2005 Vendor : XOOPS URL : http://www.xoops.org/ Version : XOOPS 2.0.11 And Earlier Risk : Multiple Vulnerabilities Description: XOOPS is a very popular dynamic web content management system written in Object Oriented PHP. One of the features of XOOPS is it's...
XML-RPC Library <= 1.3.0 (xmlrpc.php) Remote Code Injection Exploit
No description provided by source. tested and working /str0ke !/usr/bin/perl ilo-- This program is no GPL or has nothing to do with FSF, but some code was ripped from romansoft.. sorry, too lazy! xmlrpc bug by James from GulfTech Security Research. http://pear.php.net/bugs/bug.php?id=4692 xmlrpc...
XOOPS 2.0.11 && Earlier Multiple Vulnerabilities
GulfTech Security Research June 28th, 2005 Vendor : XOOPS URL : http://www.xoops.org/ Version : XOOPS 2.0.11 And Earlier Risk : Multiple Vulnerabilities Description: XOOPS is a very popular dynamic web content management system written in Object Oriented PHP. One of the features of XOOPS is it's...
Xoops < 2.0.12 Multiple XSS / SQL Injection
Binary data 3041.prm...
CVE-2002-1802
XSS vulnerability CVE-2002-1802 affects XOOPS 1.0 RC3. The flaw allows remote attackers to inject arbitrary script/HTML via Javascript in an IMG tag when submitting news, due to insufficient input sanitization in the news submission workflow. Impact is Cross‑Site Scripting; no exploit vectors or ...
CVE-2002-1802
Cross-site scripting XSS vulnerability in Xoops 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when submitting news...
CYBSEC - PHPMailer Infinite Loop Denial of Service
CYBSEC S.A. www.cybsec.com Advisory Name: PHPMailer Infinite Loop Denial of Service ============== Vulnerability Class: Denial of Service ==================== Release Date: 05.27.2005 ============= Affected Applications: ====================== PHPMailer = 1.72 Affected Platforms:...
CVE-2005-0827
Viewcat.php in 1 RUNCMS 1.1A, 2 Ciamos 0.9.2 RC1, e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops exoops, allow remote attackers to obtain sensitive information via an invalid parameter to the convertorderbytrans function, which reveals the path in a PHP error message...
CVE-2005-0828
highlight.php in 1 RUNCMS 1.1A, 2 CIAMOS 0.9.2 RC1, 3 e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops exoops, allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter, as demonstrated by reading database configuration information from...
CVE-2005-1031
CVE-2005-1031 affects RunCMS 1.1A and possibly other products based on e-Xoops (exoops). The vulnerability arises when the setting “Allow custom avatar upload” is enabled and the uploaded files are not properly verified, allowing remote attackers to upload arbitrary files. Connected sources corro...
CVE-2005-1031
RUNCMS 1.1A, and possibly other products based on e-Xoops exoops, when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files...
RunCMS Remote Arbitrary File Upload
The remote host is running RunCMS / E-Xoops, a content management system written in PHP. According to its banner, the version of this software installed on the remote host may allow a user to upload arbitrary files and potentially run them. This issue arises if avatar uploads are enabled they are...
runcms/e-xoops 1.1A and below file upload vulnerability
Products: runcms/e-xoops 1.1A http://www.runcms.org Summary: runcms/e-xoops 1.1A and below file upload vulnerability Description =========== runcms/e-xoops is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. runcms/e-xoops is the ideal tool for...
Multiple Sql injection, and multiple XSS vulnerabilities in Easy Community Management System Forum (E-XOOPS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: Multiple Sql injection, and multiple XSS vulnerabilities in Easy Community Management System Forum E-XOOPS Date: March 28, 2005 Summary...
dcrab-e-xoops.txt
Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: Multiple Sql injection, and multiple XSS vulnerabilities in Easy Community Management System Forum E-XOOPS Date: March 28, 2005 Summary: There are multiple sql injection, xss...
CVE-2005-0827
Viewcat.php in 1 RUNCMS 1.1A, 2 Ciamos 0.9.2 RC1, e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops exoops, allow remote attackers to obtain sensitive information via an invalid parameter to the convertorderbytrans function, which reveals the path in a PHP error message...
CVE-2005-0827
The CVE affects RUNCMS 1.1A, Ciamos 0.9.2 RC1, and e-Xoops 1.05 Rev3, via the Viewcat.php code path where convertorderbytrans is invoked. The underlying issue is that an invalid parameter to convertorderbytrans causes a PHP error message that reveals the filesystem path, enabling remote attackers...
CVE-2005-0828
The CVE-2005-0828 entry affects RunCMS 1.1A, Ciamos 0.9.2 RC1, and e-Xoops 1.05 Rev3 via highlight.php, where the file parameter can disclose arbitrary PHP files (e.g., mainfile.php). This information disclosure has a CVSSv2 base score of 5.0 (PARTIAL confidentiality). Remediation guidance in con...
CVE-2005-0828
highlight.php in 1 RUNCMS 1.1A, 2 CIAMOS 0.9.2 RC1, 3 e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops exoops, allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter, as demonstrated by reading database configuration information from...