Horde Application Framework Help Window Multiple Parameter XSS

The target is running at least one instance of Horde in which the help subsystem is vulnerable to a cross-site scripting attack since information passed to the help window is not properly sanitized. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See the Nessus Scripts License...

PostNuke Trojaned Distribution

The remote host seems to be running a copy of a trojaned version of the 'PostNuke' content management system. PostNuke is a content management system in PHP whose main website has been compromised between the 24th and 26th of October 2004. An attacker modified some of the source code of the tool ...

Netbilling nbmember.cgi cmd Parameter Information Disclosure

nbmember.cgi is installed on the remote host. The remote version of this software is vulnerable to an information disclosure flaw which may allow an attacker to access sensitive system information resulting in a loss of confidentiality. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Faq-O-Matic fom.cgi Multiple Parameter XSS

The remote host runs Faq-O-Matic, a CGI-based system that automates the process of maintaining a FAQ. The remote version of this software is vulnerable to cross-site scripting attacks in the script 'fom.cgi'. With a specially crafted URL, an attacker can cause arbitrary code execution resulting i...

XOOPS viewtopic.php Multiple Parameter XSS

The weblinks module of XOOPS contains a file named 'viewtopic.php' in the '/modules/newbb' directory. The code of the module insufficently filters out user provided data. The URL parameter used by 'viewtopic.php' can be used to insert malicious HTML and/or JavaScript in to the web page...

Pinnacle ShowCenter SettingsBase.php Skin Parameter XSS

The remote host runs the Pinnacle ShowCenter web-based interface. The remote version of this software is vulnerable to cross-site scripting attack due to a lack of sanity checks on skin parameter in the SettingsBase.php script. With a specially crafted URL, an attacker can cause arbitrary code...

bBlog rss.php p Parameter SQL Injection

The remote server runs a version of bBlog, a blogging system written in PHP and released under the GPL, which is as old as or older than version 0.7.4. The remote version of this software is affected by a SQL injection attack in the script 'rss.php'. This issue is due to a failure of the...

CactuShop 5.x Multiple Remote Vulnerabilities (XSS, SQLi)

The remote host runs CactuShop, an e-commerce web application written in ASP. The remote version of this software is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied-data in the script 'popuplargeimage.asp'. Successful exploitation of this issue may allow an...

BlackBoard Internet Newsboard System checkdb.inc.php libpath Parameter Remote File Inclusion

The remote host is running the BlackBoard Internet Newsboard System, an open source, PHP-based internet bulletin board software application. The remote version of this software is vulnerable to a remote file include flaw in checkdb.inc.php, due to a lack of sanitization of user-supplied data to t...

PHP-Fusion 4.01 Multiple Vulnerabilities

A vulnerability exists in the version of PHP-Fusion installed on the remote host that may allow an authenticated attacker to inject arbitrary SQL code due to improper validation of user-supplied input to the 'rowstart' parameter of script 'members.php' and the 'commentid' parameter of the...

CubeCart index.php cat_id Parameter SQL Injection

There is a SQL injection issue in the remote version of CubeCart that could allow an attacker to execute arbitrary SQL statements on the remote host and to potentially overwrite arbitrary files on the remote system, by sending a malformed value to the 'catid' argument of the file 'index.php'...

RHEL 3 : XFree86 (RHSA-2004:478)

Updated XFree86 packages that fix several security flaws in libXpm, as well as other bugs, are now available for Red Hat Enterprise Linux 3. XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user interfaces...

PHP-Fusion homepage address Parameter XSS

A vulnerability exists in the version of PHP-Fusion installed on the remote host that could allow an attacker to perform a cross-site scripting attack and execute arbitrary HTML and script code in the context of the user's browser. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

vBulletin memberlist.php what Parameter XSS

The remote version of vBulletin is vulnerable to a cross-site scripting issue due to a failure of the application to properly sanitize user-supplied URI input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be...

Pinnacle ShowCenter Skin DoS

The remote host runs the Pinnacle ShowCenter web-based interface. The remote version of this software is vulnerable to a remote denial of service due to a lack of sanity checks on skin parameter. With a specially crafted URL, an attacker can deny service of the ShowCenter web-based interface...

OpenBB board.php FID Parameter XSS

The remote host seems to be running OpenBB, a forum management system written in PHP. The remote version of this software is vulnerable to cross-site scripting attacks, through the script 'board.php'. Using a specially crafted URL, an attacker can cause arbitrary code execution for third-party...

vBulletin newreply.php WYSIWYG_HTML Parameter XSS

According to its banner, the remote version of vBulletin is vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing scrip...

BBS E-Market Professional index.php filename Parameter Traversal Arbitrary File Access

The remote host is running BBS E-Market Professional, a Korean e-commerce application written in PHP.\n There is a directory traversal vulnerability in the 'filename' parameter of '/bemarket/shop/index.php'. A remote attacker could exploit this to read sensitive information on the system...

vBulletin authorize.php x_invoice_num Parameter SQL Injection

According to its banner, the remote version of vBulletin is vulnerable to a SQL injection issue. It is reported that versions 3.0.0 through to 3.0.3 are prone to this issue. An attacker may exploit this flaw to gain the control of the remote database. %NASLMINLEVEL 70300 C Tenable Network Securit...

PostNuke News Module article.php sid Parameter XSS

The remote host is running a version of PostNuke which contains the 'News' module which itself is vulnerable to a cross-site scripting issue. An attacker may use these flaws to steal the cookies of the legitimate users of this website. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...