CVE-2004-2690

CVE-2004-2690 concerns an unrestricted file upload vulnerability in the NewsPHP Administration Panel. The issue permits remote authenticated administrators to upload and execute arbitrary code instead of video files, indicating a flaw in how uploaded content is validated and handled by the panel....

CVE-2004-2690

Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files...

SWAT Unauthenticated Access (Demo Mode)

The remote host is running SWAT, the Samba Web Administration Tool. The remote SWAT server appears to be running in demo mode. In demo mode, authentication is disabled and anyone can use SWAT to modify Samba's configuration file. Demo mode should not be used on a production server. %NASLMINLEVEL...

SimpGB version 1.46.02 File Content Disclosure Vulnerability

netVigilance Security Advisory 65 SimpGB version 1.46.02 File Content Disclosure Vulnerability Description: SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages. Features: Data stored in MySQL, Administration interface, Support for multiple...

simpgb14602-disclose.txt

netVigilance Security Advisory 65 SimpGB version 1.46.02 File Content Disclosure Vulnerability Description: SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages. Features: Data stored in MySQL, Administration interface, Support for multiple...

SimpGB version 1.46.02 Multiple Path Disclosure Vulnerabilities

netVigilance Security Advisory 64 SimpGB version 1.46.02 Multiple Path Disclosure Vulnerabilities Description: SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages. Features: Data stored in MySQL, Administration interface, Support for multip...

simpgb14602-xss.txt

netVigilance Security Advisory 67 SimpGB version 1.46.02 Multiple XSS Attack Vulnerabilities Description: SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages. Features: Data stored in MySQL, Administration interface, Support for multiple...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web administration interface in Barracuda Spam Firewall before firmware 3.5.10.016 allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt, which is not properly handled when the Monitor Web Syslog scre...

CVE-2007-5058

Cross-site scripting XSS vulnerability in the Web administration interface in Barracuda Spam Firewall before firmware 3.5.10.016 allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt, which is not properly handled when the Monitor Web Syslog scre...

CVE-2007-5058

Cross-site scripting XSS vulnerability in the Web administration interface in Barracuda Spam Firewall before firmware 3.5.10.016 allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt, which is not properly handled when the Monitor Web Syslog scre...

CVE-2007-5058

The CVE-2007-5058 issue affects the Barracuda Spam Firewall web administration interface. Affected component: login handling in the Web UI where the username field can inject arbitrary script/HTML when the Monitor Web Syslog screen is open. Root cause: improper handling of input in the login cont...

[ISR] - Barracuda Spam Firewall. Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 || ISR || || Infobyte Security Research || www.infobyte.com.ar || 09.21.2007 || .:: SUMMARY Barracuda Spam Firewall Cross-Site Scripting Version: Barracuda Spam Firewall firmware v3.4.10.102 It is suspected that all previous versions of Barracuda Sp...

Unfixed XSS vulnerability at rlt.cfbisd.edu

Security researcher onlysamurai, has submitted on 21/09/2007 a cross-site-scripting XSS vulnerability affecting rlt.cfbisd.edu, which at the time of submission ranked 252683 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

Buffalo AirStation WHR-G54S crossite request forgery

Request forgery in administration interface...

krb5 security update

CentOS Errata and Security Advisory CESA-2007:0892 Updated krb5 packages that correct a security flaw are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a network authentication system...

CVE-2007-4000

The kadm5modifypolicyinternal function in lib/kadm5/srv/svrpolicy.c in the Kerberos administration daemon kadmind in MIT Kerberos 5 krb5 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy"...

CVE-2007-4000

The kadm5modifypolicyinternal function in lib/kadm5/srv/svrpolicy.c in the Kerberos administration daemon kadmind in MIT Kerberos 5 krb5 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy"...

CVE-2007-4000

CVE-2007-4000 : In MIT Kerberos 5 kadmind, the kadm5_modify_policy_internal function fails to validate return values when the policy does not exist, allowing a remote authenticated user with the modify policy privilege to trigger a path that writes to an uninitialized pointer and potentially exec...

CVE-2007-4000

The kadm5modifypolicyinternal function in lib/kadm5/srv/svrpolicy.c in the Kerberos administration daemon kadmind in MIT Kerberos 5 krb5 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy"...

Cross site scripting

Cross-site scripting XSS vulnerability in Ipswitch WSFTP allows remote attackers to inject arbitrary web script or HTML via arguments to a valid command, which is not properly handled when it is displayed by the view log option in the administration interface. NOTE: this can be leveraged to creat...