1791 matches found
P-News p-news.php Name Field Privilege Escalation
The remote host is running the p-news bulletin board. There is a flaw in the version in use which may allow an attacker who has a 'Member' account to upgrade its privileges to administrator by supplying a malformed username. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From: "Peter...
M-TECH P-Synch 6.2.5 - Full Path Disclosure
M-TECH P-Synch 6.2.5 - Full Path Disclosure source: https://www.securityfocus.com/bid/7740/info Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request wi...
M-TECH P-Synch 6.2.5 - 'nph-psa.exe?css' Cross-Site Scripting
source: https://www.securityfocus.com/bid/7745/info P-Synch does not adequately filter HTML code from URL parameters, making it prone to cross-site scripting attacks. Code will be executed in the security context of the system running P-Synch. This may enable a remote attacker to steal cookie-bas...
M-TECH P-Synch 6.2.5 - 'nph-psf.exe?css' Remote File Inclusion
source: https://www.securityfocus.com/bid/7747/info A remote file include vulnerability has been reported for P-Synch. Due to insufficient sanitization of some user-supplied URI variables, it is possible for a remote attacker to include a malicious file in a URL. An attacker may exploit this by...
M-TECH P-Synch 6.2.5 - Full Path Disclosure
source: https://www.securityfocus.com/bid/7740/info Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request will cause P-Sync to display an error message...
pnews.txt
Admin Access Vulnerability in P-News 1.6 Url: http://www.ppopn.net It is possible to gain admin access if you possess a 'Member' account due to a flaw in the 'p-news.php' file. You can inject an entire arbitrary account, including all the fields, into the 'Name' field, which will push all the...
P-News 1.16 - Administrative Account Creation
P-News 1.16 - Administrative Account Creation source: https://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input...
P-News 1.16 - Administrative Account Creation
source: https://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of P-News. This issue was reported in...
CVE-2002-1559
Directory traversal vulnerability in ion-p.exe aka ion-p allows remote attackers to read arbitrary files via 1 C: drive letter or 2 .. dot-dot sequences in the page parameter...
CVE-2002-1559
CVE-2002-1559 describes a directory traversal flaw in ion-p.exe (ion-p) allowing remote attackers to read arbitrary files via the page parameter using C: or .. sequences. The vulnerability is web-facing, with exploitation leading to information disclosure and potential privilege escalation on som...
