• Skip to main content
  • Skip to footer

Audit My PC - Free Internet Security Audit

Firewall Test and web tools to check your security and privacy

  • Firewall Test
  • Anti Spam
  • Internet Speed Test
  • Sitemap Generator
  • Whats My IP

CubeCart admin/filemanager/preview.php Multiple Variable XSS

Network Security News – Saturday, September 02, 2006 Events

CubeCart admin/filemanager/preview.php Multiple Variable XSS

CubeCart contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'file', 'x' and 'y' variables upon submission to the 'admin/filemanager/preview.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/27986

ClickCart default.asp cat Variable XSS

ClickCart contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'cat' variable upon submission to the 'default.asp' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/26342

WWWthreads calendar.php week Variable XSS

WWWthreads contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'week' variable upon submission to the 'calendar.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/27542

PHP iAddressBook vCard Handling XSS

PHP iAddressBook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified parameters when adding a contact and importing or exporting a vCard. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/28173

PHP iAddressBook q Form Field XSS

PHP iAddressBook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'q' form field upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/28172

Shadows Rising RPG smarty.inc.php CONFIG[gameroot] Variable Remote File Inclusion

Shadows Rising RPG contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to '/core/includes/smarty.inc.php', '/qcms/includes/smarty.inc.php' and '/qlib/smarty.inc.php' scripts not properly sanitizing user input supplied to the 'CONFIG[gameroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more at osvdb.org/28282

Shadows Rising RPG security.inc.php CONFIG[gameroot] Variable Remote File Inclusion

Shadows Rising contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to '/core/includes/security.inc.php'
not properly sanitizing user input supplied to the 'CONFIG[gameroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more at osvdb.org/28283

vBulletin Attachment Handling .pdf File XSS

vBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to the unspecified script. This could allow a user to upload an attachment with a .pdf extension that contains script code, that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/27778

vBulletin Unspecified XSS

vBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/27777

Vanilla CMS upgrader.php RootDirectory Variable Remote File Inclusion (Myth/Fake)

Vanilla CMS has been reported to contain a flaw that may allow a remote attacker to execute arbitrary commands. The issue is supposedly due to the upgrader.php script not properly sanitizing user input supplied to the 'RootDirectory' variable. However, subsequent evaluation indicates that an attacker can not manipulate the variable as reported.. Read more at osvdb.org/28287

Vuln: WikiWebWeaver Index.PHP Arbitrary File Upload Vulnerability

WikiWebWeaver Index.PHP Arbitrary File Upload Vulnerability. Read more at securityfocus.com/bid/19537

Vuln: AlstraSoft Template Seller Config[Template_Path] Multiple Remote File Include Vulnerabilities

AlstraSoft Template Seller Config[Template_Path] Multiple Remote File Include Vulnerabilities. Read more at securityfocus.com/bid/19769

Vuln: Sun Java Applet Invocation Version Specification Weakness

Sun Java Applet Invocation Version Specification Weakness

. Read more at securityfocus.com/bid/11757

Vuln: ZoneX Usercp_Register.PHP Remote File Include Vulnerability

ZoneX Usercp_Register.PHP Remote File Include Vulnerability. Read more at securityfocus.com/bid/19338

[SECURITY] [DSA 1165-1] New capi4hylafax packages fix arbitrary command execution

[SECURITY] [DSA 1165-1] New capi4hylafax packages fix arbitrary command execution. Read more at securityfocus.com/archive/1/444955

ISS BlackICE PC Protection Insufficient validation of arguments of NtOpenSection Vulnerability

ISS BlackICE PC Protection Insufficient validation of arguments of NtOpenSection Vulnerability

. Read more at securityfocus.com/archive/1/444958

[Informix] Is Telelogic’s Synergy integrated Informix server also vulnerable?

[Informix] Is Telelogic’s Synergy integrated Informix server also vulnerable?. Read more at securityfocus.com/archive/1/444963

[ MDKSA-2006:160 ] – Updated xorg-x11/XFree86 packages fix potential vulnerabilities

[ MDKSA-2006:160 ] – Updated xorg-x11/XFree86 packages fix potential vulnerabilities. Read more at securityfocus.com/archive/1/444962

Reader Interactions

Leave a Reply

Your email address will not be published. Required fields are marked *

Footer

Miscellaneous

  • Free Address Finder
  • HTML Encoder Decoder
  • Website Monitoring
  • Whats My IP Address?
  • Yes or No

Copyright © 2001-2021 Audit My PC .com All Rights Reserved. Our Privacy Policy and TOS

  • About
  • Acronyms
  • DLL Files
  • Ports
  • Computer Security News
  • Email Scams & Spam
  • Internet Safety
  • Free Software