33 matches found
EUVD-2008-6733
Malware in sbrugna...
EUVD-2008-6731
Malware in sbrugna...
EUVD-2008-6734
Malware in sbrugna...
EUVD-2008-6729
Malware in sbrugna...
EUVD-2008-6415
Malware in sbrugna...
yourplace <= 1.0.2 - Multiple Vulnerabilities + rce exploit
No description provided by source. START 0x01 Informations: Script : YourPlace 0.5 beta 1 Download : http://www.hotscripts.com/jump.php?listingid=80545&jumptype=1 Vulnerability : DB Disclosure / Arbitrary Data Saving RCE EXPLOIT / Arbitrary File Upload / PHPInfo Disclosure / User Change Account...
Code injection
Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the 1 fav1url, 2 fav1name, 3 fav2url, 4 fav2name, 5 fav3url, 6 fav3name, 7 fav4url, 8 fav4nam...
CVE-2008-6770
YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt...
CVE-2008-6772
login/registerform.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a new account with the username of a target user...
Information disclosure
internettoolbar/edit.php in YourPlace 1.0.2 and earlier does not end execution when an invalid username is detected, which allows remote attackers to bypass intended restrictions and edit toolbar settings via an invalid username. NOTE: the provenance of this information is unknown; the details ar...
Improper access control
YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt...
CVE-2008-6771
YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/phpinfo.php, which calls the phpinfo function...
CVE-2008-6769
Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...
CVE-2008-6774
internettoolbar/edit.php in YourPlace 1.0.2 and earlier does not end execution when an invalid username is detected, which allows remote attackers to bypass intended restrictions and edit toolbar settings via an invalid username. NOTE: the provenance of this information is unknown; the details ar...
CVE-2008-6773
Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the 1 fav1url, 2 fav1name, 3 fav2url, 4 fav2name, 5 fav3url, 6 fav3name, 7 fav4url, 8 fav4nam...
CVE-2008-6770
CVE-2008-6770 affects YourPlace 1.0.2 and earlier. It stems from insufficient access control that allows remote attackers to retrieve a users.txt database file containing credentials by requesting it directly from the web root. The vulnerability detail is confined to stored sensitive data exposur...
CVE-2008-6769
Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...
CVE-2008-6774
internettoolbar/edit.php in YourPlace 1.0.2 and earlier does not end execution when an invalid username is detected, which allows remote attackers to bypass intended restrictions and edit toolbar settings via an invalid username. NOTE: the provenance of this information is unknown; the details ar...
CVE-2008-6773
Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the 1 fav1url, 2 fav1name, 3 fav2url, 4 fav2name, 5 fav3url, 6 fav3name, 7 fav4url, 8 fav4nam...
CVE-2008-6771
YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/phpinfo.php, which calls the phpinfo function...