PRADO ViewState Data Nondescript Issue

Network Security News – Tuesday, May 10, 2005 Events

PRADO ViewState Data Nondescript Issue

PRADO contains a flaw related to the viewstate data that may allow a remote attacker to gain access to unencrypted data. No further details have been provided.. Read more at osvdb.org/16194

ASP Inline Corporate Calendar details.asp Event_ID SQL Injection

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the details.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.. Read more at osvdb.org/16193

ASP Inline Corporate Calendar defer.asp Event_ID Variable SQL Injection

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the defer.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.. Read more at osvdb.org/16192

SimpleCam Web Server Traversal Arbitrary File Access

SimpleCam contains a flaw that allows a remote attacker to access arbitrary files outside of the web path. The issue is due to the internal web server not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the URI.. Read more at osvdb.org/16178

MidiCart PHP Shopping Cart item_show.php code_no Variable SQL Injection

MidiCart PHP contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'code_no' variable in the item_show.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.. Read more at osvdb.org/16177

MidiCart PHP Shopping Cart item_list.php Multiple Variable SQL Injection

MidiCart PHP contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'maingroup' and 'secondgroup' variables in the item_list.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.. Read more at osvdb.org/16176

MidiCart PHP Shopping Cart item_list.php Multiple Variable XSS

MidiCart PHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'secondgroup' or 'maingroup' variables upon submission to the item_list.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/16174

MidiCart PHP Shopping Cart search_list.php searchstring Variable XSS

MidiCart PHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'searchstring' variable upon submission to the search_list.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/16173

MidiCart PHP Shopping Cart Multiple Script Direct Request Path Disclosure

MidiCart PHP contains a flaw that may lead to an unauthorized information disclosure. Өe issue is triggered when a remote attacker directly requests scripts such as 'search_list.php', 'item_list.php' or 'item_show.php' which will disclose the full installation path. This occurs due to undefined variables triggering an error when display_errors is set to 'ON' in the php.ini file.. Read more at osvdb.org/16172

MidiCart PHP Shopping Cart search_list.php searchstring Variable SQL Injection

MidiCart PHP contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'searchstring' variable in the search_list.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.. Read more at osvdb.org/16175