Page 3 of 20 results (0.025 seconds)

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1

CVE-2009-3118

https://notcve.org/view.php?id=CVE-2009-3118

SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php. Vulnerabilidad de inyección SQL en mod/poll/comment.php en el módulo de voto en Danneo CMS v0.5.2 anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "context", conjuntamente con los parámetros modificados "comname" y "comtitle" en una acción "poll" al index.php. Relacionado con una limpieza incorrecta de los datos de entrada en base/danneo.function.php. • http://packetstormsecurity.org/0908-exploits/danneo052-sql.txt http://secunia.com/advisories/36440 http://www.vupen.com/english/advisories/2009/2459 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 2

CVE-2009-2163 – Sitecore CMS 6.0.0 rev. 090120 - 'default.aspx' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2009-2163

Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Sitecore CMS versiones anteriores a v6.0.2 Update-1 090507 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el parámetro "sc_error". • https://www.exploit-db.com/exploits/34930 http://forum.intern0t.net/intern0t-advisories/1082-intern0t-sitecore-net-6-0-0-cross-site-scripting-vulnerability.html http://secunia.com/advisories/35353 http://www.securityfocus.com/archive/1/504093/100/0/threaded http://www.securityfocus.com/archive/1/504132/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.3EPSS: 1%CPEs: 14EXPL: 0

CVE-2009-0584 – argyllcms: Multiple insufficient upper-bounds checks on certain sizes in the International Color Consortium Format Library

https://notcve.org/view.php?id=CVE-2009-0584

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. icc.c, perteneciente a la librería de formatos del International Color Consortium (ICC) (alias icclib), tal y como se utiliza en Ghostscript 8.64 y anteriores y Argyll Color Management System (CMS) 1.0.3 y anteriores, permite causar una denegación de servicio (con caída de la aplicación) a atacantes dependientes de contexto, o posiblemente ejecutar código arbitrario por medio de un fichero de dispositivo diseñado para procesar archivos de imagen con modificaciones relacionadas con valores enteros grandes para determinados tamaños, en relación con un perfil ICC en un (1) PostScript o (2) un archivo PDF con imágenes incrustadas. • http://bugs.gentoo.org/show_bug.cgi?id=261087 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://osvdb.org/52988 http://secunia.com/advisories/34266 http://secunia.com/advisories/34373 http://secunia.com/advisories/34381 http://secunia.com/advisories/34393 http://secunia.com/advisories/34398 http://secunia.com/advisories/34418 http://secunia.com/advisories/34437 http://secunia.com/advisories/34443 http://secunia.com/advisories/34469 http: • CWE-189: Numeric Errors •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3

CVE-2008-4601 – Habari 0.5.1 - 'habari_username' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-4601

Cross-site scripting (XSS) vulnerability in the login feature in Habari CMS 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the habari_username parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad de autenticación en Habari CMS v0.5.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro "habari_username". • https://www.exploit-db.com/exploits/32492 http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt http://secunia.com/advisories/32311 http://www.securityfocus.com/bid/31794 https://exchange.xforce.ibmcloud.com/vulnerabilities/45951 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2008-2843 – doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-2843

Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp. Múltiples vulnerabilidades de inyección SQL en doITLive CMS 2.50 y versiones anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro (1) ID en una ación USUB a default.asp y el (2) Licence[SpecialLicenseNumber] (también conocido como LicenceId) cookie to edit/default.asp. • https://www.exploit-db.com/exploits/5849 http://secunia.com/advisories/30705 http://www.bugreport.ir/?/43 http://www.securityfocus.com/bid/29789 https://exchange.xforce.ibmcloud.com/vulnerabilities/43161 https://exchange.xforce.ibmcloud.com/vulnerabilities/43163 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •