HP Openview connectedNodes.ovpl Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HP Openview...

HP OpenView Network Node Manager远程命令执行漏洞

BUGTRAQ ID: 33666 CVE ID：CVE-2008-4559 CNCVE ID：CNCVE-20084559 HP OpenView Network Node Manager是一款HP公司开发和维护的网络管理系统软件，具有强大的网络节点管理功能。 HP OpenView Network Node Manager CGI应用程序存在多个命令注入漏洞，远程攻击者可以利用漏洞执行任意SHELL命令。...

Real IIS always the back door decryption-bug warning-the black bar safety net

IIS is more popular in the www server, set the undue vulnerability on the lot. The invasion of the iis server after leaving the back door, since you can always control. Generally the backdoor is open a special Port to monitor, such as a nc,ntlm,rnc, etc. are based on a class telnet mode on the...

Arbitrary file disclosure vulnerability in rrdbrowse <= 1.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I - TITLE Security advisory: Arbitrary file disclosure vulnerability in rrdbrowse II - SUMMARY Description: Arbitrary file disclosure vulnerability in rrdbrowse = 1.6 Author: Sebastian Wolfgarten sebastian at wolfgarten dot com, http://www.devtarget.o...

RRDBrowse <= 1.6 Remote Arbitrary File Disclosure Vulnerability

Exploit for cgi platform in category web applications =============================================================== RRDBrowse = 1.6 Remote Arbitrary File Disclosure Vulnerability =============================================================== I - TITLE Security advisory: Arbitrary file disclosu...

openview_connectednodes_exec.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Apache web server DoS

Wide HTTP request byterange paramters for CGI application leads to memory exhaustion...

HP Openview connectedNodes.ovpl Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the HP OpenView connectedNodes.ovpl CGI application. The results of the command will be displayed to the screen. Module Options msf use exploit/unix/webapp/openview/connectednodesexec msf undefinedconnectednodesexec show actions...

CVE-2002-1592

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

CVE-2002-1592: Undefined Security Weakness

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

GLSA-200502-21 : lighttpd: Script source disclosure

The remote host is affected by the vulnerability described in GLSA-200502-21 lighttpd: Script source disclosure lighttpd uses file extensions to determine which elements are programs that should be executed and which are static pages that should be sent as-is. By appending %00 to the filename, yo...

iDEFENSE Security Advisory 01.13.05: MySQL MaxDB WebAgent websql logon Buffer Overflow Vulnerability

MySQL MaxDB WebAgent websql logon Buffer Overflow Vulnerability iDEFENSE Security Advisory 01.13.05 www.idefense.com/application/poi/display?id=181&type=vulnerabilities January 13, 2005 I. BACKGROUND MaxDB by MySQL is a re-branded and enhanced version of SAP DB, SAP AG's open source database. Max...

Movable Type mt-load.cgi Privilege Escalation

The remote web server is hosting Movable Type with 'mt-load.cgi' installed. Failure to remove mt-load.cgi could enable someone else to create a weblog in your Movable Type installation, and possibly gain access to your data. %NASLMINLEVEL 70300 This script was written by Rich Walchuck rich.walchu...

F-Secure Policy Manager 5.11 - FSMSH.dll CGI Application Installation Full Path Disclosure

F-Secure Policy Manager 5.11 - FSMSH.dll CGI Application Installation Full Path Disclosure source: https://www.securityfocus.com/bid/11869/info F-Secure Policy Manager includes a CGI application named 'fsmsh.dll'. By supplying unexpected input as an argument to the 'fsmsh.dll' application the...

F-Secure Policy Manager 5.11 - 'FSMSH.dll' CGI Application Installation Full Path Disclosure

source: https://www.securityfocus.com/bid/11869/info F-Secure Policy Manager includes a CGI application named 'fsmsh.dll'. By supplying unexpected input as an argument to the 'fsmsh.dll' application the vulnerable software will return an error message that includes the installation path of the...

YaBB Shadow BBCode Tag XSS

The remote host is using the YaBB web forum software. According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using shadow or glow tags. This may allow an attacker to inject hostile JavaScript into the forum system, to steal cookie...

CVSTrac timeline.c timeline_page Function Overflow

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to the timelinepage function in timeline.c that may allow an attacker to cause a buffer overflow. An attacker, exploiting this flaw, would be potentially able t...

CVSTrac cgi.c Multiple Overflows

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains multiple flaws in the mprintf, vmprintf, and vxprintf functions in cgi.c . A remote attacker, exploiting this flaw, would be able to execute arbitrary code on the remote syste...

CVSTrac history.c history_update Function Overflow

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to the historyupdate function in history.c that may allow an attacker to cause a buffer overflow and execute arbitrary code on the remote system. Nessus has...

WackoWiki TextSearch phrase Parameter XSS

The remote host seems to be running the WackoWiki CGI suite. Based on the version information gathered by Nessus, this instance of WackoWiki may be vulnerable to a remote authentication attack. Exploitation of this vulnerability may allow for theft of cookie-based authentication credentials and...