IMHO Webmail 0.9x - Account Hijacking

source: https://www.securityfocus.com/bid/5238/info A vulnerability has been reported in the IMHO Roxen webmail module which may enable a malicious user of the webmail system to gain access to the account of another user. This issue is due to an error in configuration which may leak the REFERER f...

[NT] Lil' HTTP Server "Referer" Cross Site Scripting Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

Проблемы с susehelp в SuSE (directory traversal)

В sdbsearch.cgi используется поле Referer: клиентского запроса, которое может сожержать обратный путь...

CVE-1999-1522

Vulnerability in htmlparse.pike in Roxen Web Server 1.3.11 and earlier, possibly related to recursive parsing and referer tags in RXML...

CVE-1999-1522: Undefined Security Weakness

Vulnerability in htmlparse.pike in Roxen Web Server 1.3.11 and earlier, possibly related to recursive parsing and referer tags in RXML...

CVE-2000-0716: Undefined Security Weakness

WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email...

CVE-2000-0908: Undefined Security Weakness

BrowseGate 2.80 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long Authorization or Referer MIME headers in the HTTP request...

Проблемы в Browsegate

Длинное поле Referer HTTP-запроса приводит к переполнению буфера в прокси-сервере. Кроме того, пароли хранятся в тривиальной кодировке допускающей обратное преобразование...

Mail File POST Vulnerability

MailFile v 1.10 by Oatmeal-Studios http://www.oatmeal-studios.com This Perl script enables a site's visitor to have a given file dispatched to a specified email address. The visitor is required to select the file from a given list and to enter his or her email address. The data will then be...

GWScripts News Publisher 1.0 - 'author.file' Write

source: https://www.securityfocus.com/bid/1621/info It is possible for a remote user to add an author to the author index author.file in GWScripts News Publisher, a web news publisher. This can be done by requesting the following raw HTTP request using any arbitrary username and password: POST...

CVE-1999-1522

Vulnerability in htmlparse.pike in Roxen Web Server 1.3.11 and earlier, possibly related to recursive parsing and referer tags in RXML...