Cross site scripting

Cross-site scripting XSS vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page...

CVE-2008-0899

CVE-2008-0899 describes a cross-site scripting (XSS) vulnerability in the Administration Console of BEA WebLogic Server and Express 9.0–10.0. The issue arises because URLs are not properly handled by the Unexpected Exception Page, allowing remote attackers to inject arbitrary web script or HTML. ...

Session fixation

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session...

CVE-2008-0870

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session...

CVE-2008-0838

Multiple cross-site scripting XSS vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 error and 2 go parameters to the login page...

CVE-2008-0838

Multiple cross-site scripting XSS vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 error and 2 go parameters to the login page...

CVE-2008-0823

Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors...

CVE-2008-0823

Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors...

Default Password (changeme) for SHOUTcast Server Service Port

The remote SHOUTcast Server's service port is configured to use the default password to allow broadcasting content and administration. Knowing it, an attacker can gain administrative control of the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Philips VOIP841 (Firmware <= 1.0.4.800) Multiple Vulnerabilities

No description provided by source. .: Philips VOIP841 Multiple Vulnerabilities :. Luca "ikki" Carettoni - [email protected] Systems affected: Philips VOIP841, Firmware Version 1.0.4.50 and 1.0.4.80, Web Server Version 1.5 simple httpd Systems not affected: n/a a Hidden Administration...

SOPHOS Email Security Appliance crossite scripting

Administration interface crossite scripting...

philipsvoip-multi.txt

Secure Network - Security Research Advisory Vuln name: Philips VOIP841 Multiple Vulnerabilities Systems affected: Philips VOIP841, Firmware Version 1.0.4.50 and 1.0.4.80, Web Server Version 1.5 simple httpd Systems not affected: n/a Severity: High Local/Remote: Remote Vendor URL:...

Philips VOIP841 (Firmware <= 1.0.4.800) Multiple Vulnerabilities

Exploit for hardware platform in category remote exploits ================================================================ Philips VOIP841 Firmware alert"XSS"; HTTP/1.0 d Insecure Storage Skype credentials, web management console passwords, ... /var/jffs2/data/save.dat /tmp/apply.log 0day.today...

Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities

.: Philips VOIP841 Multiple Vulnerabilities :. Luca "ikki" Carettoni - [email protected] Systems affected: Philips VOIP841, Firmware Version 1.0.4.50 and 1.0.4.80, Web Server Version 1.5 simple httpd Systems not affected: n/a a Hidden Administration Account web management console...

CVE-2008-0742

Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. dot dot in the 1 subpage parameter in a categories.inc.php, b news.inc.php, c other.inc.php, d permissions.inc.php, e templates.inc.php, and f...

Directory traversal and DoS in WinIPDS G52-33-021

Luigi Auriemma Application: Intermate WinIPDS http://www.intermate.com/ipdssoftware Versions: = Release 3.3 Revision G52-33-021 Platforms: Windows Bugs: A directory traversal in web administration B Denial of Service versus the IPDS port Exploitation: remote Date: 12 Feb 2008 Author: Luigi Auriem...

CVE-2007-3676

IBM DB2 Universal Database UDB Administration Server DAS 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory...

SA-2008-017 - Header image - Access bypass

The Header image module allows sites to display an image on selected pages based on the node id, path, taxonomy, node type, containing book or the result of PHP code. The module contains a vulnerability where access to the module's administration pages is granted to any user, including the...

CVE-2007-3676

IBM DB2 Universal Database UDB Administration Server DAS 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory...

CVE-2007-3676

CVE-2007-3676 concerns IBM DB2 UDB DAS prior to Fix Pack 16 (DAS 8.x) and Fix Pack 4 (DAS 9.x). The vulnerability allows a remote attacker to crash the DAS service or potentially execute arbitrary code by sending specially crafted remote administration requests that modify pointer values, trigger...