CVSTrac filediff vulnerability

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version of filediff has a flaw in the input sanitation which, when exploited, can lead to a remote attacker executing arbitrary commands on the system. OpenVAS has determined the vulnerability...

CVSTrac timeline.c timeline_page function overflow

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to the timelinepage function in timeline.c that may allow an attacker to cause a buffer overflow. An attacker, exploiting this flaw, would be potentially able t...

SQLQHit Directory Structure Disclosure

The Sample SQL Query CGI is present. The sample allows anyone to structure a certain query that would retrieve the content of directories present on the local server. OpenVAS Vulnerability Test $Id: sqlqhitinformationdisclosure.nasl 5786 2017-03-30 10:08:58Z cfi $ Description: SQLQHit Directory...

Apache <= 1.3.33 htpasswd local overflow

The remote host appears to be running Apache 1.3.33 or older. There is a local buffer overflow in the 'htpasswd' command in these versions that may allow a local user to gain elevated privileges if 'htpasswd' is run setuid or a remote user to run arbitrary commands remotely if the script is...

guestbook.cgi

The 'guestbook.cgi' is installed. This CGI has a well known security flaw that lets anyone execute arbitrary commands with the privileges of the http daemon root or nobody. OpenVAS Vulnerability Test $Id: guestbook.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: guestbook.cgi Authors: Mathie...

ping.asp

The 'ping.asp' CGI is installed. Some versions allows a cracker to launch a ping flood against your machine or another by entering '127.0.0.1 -l 65000 -t' in the Address field. OpenVAS Vulnerability Test $Id: pingasp.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: ping.asp Authors: Michel...

msmmask.exe

The msmmask.exe CGI is installed. Some versions allow an attacker to read the source of any file in your webserver's directories by using the 'mask' parameter. OpenVAS Vulnerability Test $Id: msmmask.nasl 5786 2017-03-30 10:08:58Z cfi $ Description: msmmask.exe Authors: Michel Arboi Copyright:...

OmniPro HTTPd 2.08 scripts source full disclosure

OmniPro HTTPd 2.08 suffers from a security vulnerability that permits malicious users to get the full source code of scripting files. By appending an ASCII/Unicode space char '%20' at the script suffix, the web server will no longer interpret it and rather send it back clearly as a simple documen...

Linksys Wireless Internet Camera File Disclosure

The Linksys Wireless Internet Camera contains a CGI that allows remote attackers to disclosue sensitive files stored on the server. An attacker may use this CGI to disclosue the password file and from it the password used by the root use the MD5 value. OpenVAS Vulnerability Test $Id:...

Trend Micro Emanager .dll Files Vulnerability

The Trend Micro Emanager software resides on this server. Some versions of this software have vulnerable dlls. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

alya.cgi

alya.cgi is a cgi backdoor distributed with multiple rootkits. OpenVAS Vulnerability Test $Id: alya.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: alya.cgi Authors: Jason Lidow Copyright: Copyright C 2002 Jason Lidow This program is free software; you can redistribute it and/or modify it...

Agora CGI Cross Site Scripting

The remote web server contains a CGI which is vulnerable to a cross-site scripting issue. Description : Agora is a CGI based e-commerce package. Due to poor input validation, Agora allows an attacker to execute cross-site scripting attacks. SPDX-FileCopyrightText: 2002 Matt Moore Some text...

phpGedView Code injection Vulnerability

The remote host is running phpGedView, a set of CGI scripts which parse GEDCOM 5.5 genealogy files and display them on the internet in a format similar to desktop programs. There are multiple vulnerabilities in this product : - A path disclosure vulnerability, which will give more information abo...

PGPMail.pl detection

The SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.11070";...

CVSTrac CVSROOT/passwd arbitrary account deletion

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version of CVSTRAC is vulnerable to a flaw wherein a remote attacker can overwrite a critical file, thereby giving them elevated access and potentially control over other user accounts...

MRTG mrtg.cgi File Disclosure

The mrtg.cgi script is part of the MRTG traffic visualization application. A vulnerability exists in this script which allows an attacker to view the first line of any file on the system. SPDX-FileCopyrightText: 2002 Digital Defense Inc. Some text descriptions might be excerpted from a referenced...

Detection of various dangerous CGI scripts (HTTP) - Active Check

Various CGI scripts have known vulnerabilities tracked via the via the referenced CVEs. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only Also cove...

cgi.rb

The SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.15710";...

nph-publish.cgi

The SPDX-FileCopyrightText: 1999 Mathieu Perrin Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10164";...

Whatsup Gold vulnerable CGI

The SPDX-FileCopyrightText: 2004 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.15564";...