Vulnerabilities > THE Address Book

DATE CVE VULNERABILITY TITLE RISK
2006-12-31 CVE-2006-4582 Cross-Site Request Forgery vulnerability in the Address Book the Address Book 1.04E
Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.
network
low complexity
the-address-book
5.0
2006-12-31 CVE-2006-4581 Remote vulnerability in the Address Book the Address Book 1.04E
Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts.
network
low complexity
the-address-book
5.0
2006-12-31 CVE-2006-4580 Remote vulnerability in the Address Book the Address Book 1.04E
register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm".
network
low complexity
the-address-book
7.5
2006-12-31 CVE-2006-4579 Remote vulnerability in the Address Book the Address Book 1.04E
Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a ..
network
low complexity
the-address-book
5.0
2006-12-31 CVE-2006-4578 Remote vulnerability in the Address Book the Address Book 1.04E
export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
network
low complexity
the-address-book
7.5
2006-12-31 CVE-2006-4577 Remote vulnerability in the Address Book the Address Book 1.04E
Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.
6.8
2006-12-31 CVE-2006-4576 Remote vulnerability in the Address Book the Address Book 1.04E
Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer.
6.8
2006-12-31 CVE-2006-4575 Remote vulnerability in the Address Book the Address Book 1.04E
Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) defaultLetter, (8) newuserPass, (9) newuserType, (10) newuserEmail parameters in (a) user.php; the (11) goTo and (12) search parameters in (b) search.php; and the (13) groupAddName parameter in (c) save.php.
network
low complexity
the-address-book
7.5
2006-08-10 CVE-2006-4056 SQL Injection vulnerability in The Address Book Login Page
Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
7.5