CVE-2012-1198: Improper Input Validation

baseagmain.php in Basic Analysis and Security Engine BASE 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action...

CVE-2012-1199: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine BASE 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 BASEpath parameter to baseagmain.php, 2 basedbsetup.php, 3 basegraphcommon.php, 4 basegraphdisplay.php, 5 basegraphform.php, ...

PT-2012-3125

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine BASE version 1.4.5 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a create action, and then accessing it via a view action. This i...

PT-2012-3126

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine BASE version 1.4.5 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in various parameters, including the BASE path parameter to multiple PHP files, the GLOBALSuser session...

CVE-2012-1017: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in baseqrymain.php in Basic Analysis and Security Engine BASE 1.4.5 allow remote attackers to execute arbitrary SQL commands via the 1 ipaddr01, 2 ipaddr02, or 3 ipaddr09 parameters...

PT-2012-3016

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine BASE version 1.4.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the base qry main.php file, specifically via the i...

CVE-2009-4839: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Basic Analysis and Security Engine BASE, possibly 1.4.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 admin/baseroleadmin.php, 2 admin/baseuseradmin.php, 3 baseconfcontents.php, 4...

CVE-2009-4838: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in baseagcommon.php in Basic Analysis and Security Engine BASE before 1.4.3.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information...

CVE-2009-4837: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Basic Analysis and Security Engine BASE before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 sig1 parameter to base/baseqrymain.php, or the time01 parameter to 2 base/basestatalerts.php or 3...

CVE-2009-4592: Undefined Security Weakness

Unspecified vulnerability in baselocalrules.php in Basic Analysis and Security Engine BASE before 1.4.4 allows remote attackers to include arbitrary local files via unknown vectors...

CVE-2005-4878: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 acidqrymain.php in Analysis Console for Intrusion Databases ACID 0.9.6b20 and 2 baseqrymain.php in Basic Analysis and Security Engine BASE 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrar...

CVE-2007-5578: Improper Authentication

Basic Analysis and Security Engine BASE before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via 1 basemain.php, 2 baseqryalert.php, and possibly other vectors...

CVE-2006-2685: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine BASE 1.2.4 and earlier, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASEpath parameter to 1 baseqrycommon.php, 2 basestatcommon.php, and 3...

CVE-2006-1590: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the PrintFreshPage function in 1 Basic Analysis and Security Engine BASE 1.2.4 and 2 Analysis Console for Intrusion Databases ACID 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the a back parameter to basegraphmain.php, b...

CVE-2006-1505: Undefined Security Weakness

basemaintenance.php in Basic Analysis and Security Engine BASE before 1.2.4 melissa, when running in standalone mode, allows remote attackers to bypass authentication, possibly by setting the standalone parameter to "yes"...