3 results (0.006 seconds)

CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 3

CVE-2007-5127 – SimpGB 1.46.2 - '/admin/?l_username' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2007-5127

Multiple cross-site scripting (XSS) vulnerabilities in SimpGB 1.46.02 allow remote attackers to inject arbitrary web script or HTML via (1) the l_username parameter to the default URI under admin/ or (2) the l_emoticonlist parameter to admin/emoticonlist.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SimpGB 1.46.02 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante los parámetros (1) l_username al URI por defecto bajo admin/ o (2) l_emoticonlist a admin/emoticonlist.php. • https://www.exploit-db.com/exploits/30615 https://www.exploit-db.com/exploits/30616 http://forum.boesch-it.de/viewtopic.php?t=2790 http://secunia.com/advisories/26974 http://securityreason.com/securityalert/3171 http://www.netvigilance.com/advisory0067 http://www.securityfocus.com/archive/1/480596/100/0/threaded http://www.securityfocus.com/bid/25808 https://exchange.xforce.ibmcloud.com/vulnerabilities/36773 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2007-5129

https://notcve.org/view.php?id=CVE-2007-5129

SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain sensitive configuration information via a direct request for admin/cfginfo.php; and (2) download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc. SimpGB 1.46.02 almacena información sensible bajo la raíz de documentos web con control de acceso insuficiente, lo cual permite a atacantes remotos (1) obtener información sensible de la configuración mediante una petición directa a admin/cfginfo.php; y (2) descargar ficheros .inc de su elección mediante una petición directa, como ha sido demostrado por admin/includes/dbtables.inc. • http://forum.boesch-it.de/viewtopic.php?t=2790 http://osvdb.org/40612 http://osvdb.org/40613 http://secunia.com/advisories/26974 http://www.netvigilance.com/advisory0065 http://www.netvigilance.com/advisory0066 http://www.securityfocus.com/archive/1/480590/100/0/threaded http://www.securityfocus.com/archive/1/480592/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/36776 https://exchange.xforce.ibmcloud.com/vulnerabilities/36777 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2007-5130

https://notcve.org/view.php?id=CVE-2007-5130

SimpGB 1.46.02 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php or (2) a direct request to admin/trailer.php, which reveals the path in various error messages. SimpGB 1.46.02 permite a atacantes remotos obtener información sensible mediante (1) un parámetro lang a admin/index.php o (2) una petición directa a admin/trailer.php, lo cual revela la ruta en varios mensajes de error. • http://forum.boesch-it.de/viewtopic.php?t=2790 http://securityreason.com/securityalert/3172 http://www.netvigilance.com/advisory0064 http://www.securityfocus.com/archive/1/480593/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/36775 • CWE-20: Improper Input Validation •