CVE-2006-1676

MAXdev MDPro MD-Pro

CVE-2006-1677

CVE-2006-1677 affects MAXdev MDPro versions prior to 1.076, including 1.0.72/1.0.73. Root cause is an insecure direct access path to includes/legacy.php that allows remote attackers to obtain the server’s full filesystem path. Impact is partial confidentiality exposure (full path disclosure) with...

CVE-2006-4964

MAXdev MDPro contains a cross-site scripting (XSS) vulnerability in versions prior to 1.0.76, fixed in a release after 20060918. The issue arises from vectors that bypass the pnVarCleanFromInput XSS protections and from unspecified AntiCracker-related vectors. Affected product/component: MAXdev M...