9911 matches found
ultimateCGI.txt
The ultimate CGI Guestbook Scripts MegaBook V2.0 appears vulnerable to Cross Site Scripting, which will allow the attacker to modify the post in the guestbook. The affected scripts is admin.cgi URL: http://www.yourdomain.com/yourcgidir/admin.cgi I have tested the script with the following query:...
PHP, ASP, CGI web applications security vulnerabilities
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
CVE-2002-2113
CVE-2002-2113 concerns AGH HTMLsearch 1.0. The vulnerability resides in the CGI script search.cgi, where the template parameter can be tainted to pass shell metacharacters. This enables a remote attacker to execute arbitrary commands on the affected system. The available documents consistently de...
JVN#29273468 QRcode Perl CGI & PHP script vulnerable to denial of service attack
Impact A remote attacker may cause a denial of service DoS attack. Solution Products Affected QRcode Perl/CGI & PHP script ver. 0.50f and earlier including both Perl versions and PHP versions...
Community Link Pro login.cgi file Parameter Arbitrary Command Execution
The remote host is running Community Link Pro, a web-based application written in Perl. The remote version of this software fails to sanitize user input to the 'file' parameter of the 'login.cgi' script of shell metacharacters before using it to run a command. An unauthenticated attacker can...
Advanced Guestbook User-Agent Header HTML Injection
The remote host is running Advanced Guestbook, a free guestbook written in PHP. The installed version of Advanced Guestbook fails to properly sanitize the 'HTTPUSERAGENT' environment variable before using it in dynamically-generated content. An attacker can exploit this flaw to launch cross-site...
FtpLocate flsearch.pl fsite Parameter Remote File Inclusion
The remote host is running FtpLocate, a web search engine for FTP sites written in Perl. The installed version of FtpLocate allows remote attackers to execute commands on the remote host by manipulating input to the 'fsite' parameter in various scripts. %NASLMINLEVEL 70300 C Tenable Network...
FtpLocate 2.02 - 'current' Remote Command Execution
Alot of code for a cgi | vuln. /str0ke !/usr/bin/perl FtpLocate newPeerAddr = $host, PeerPort = 80, Proto = "tcp" or die "socket: "; sub ch2hex $chr = $0; $out=""; for$i=0;$i; print "remote file: "; chomp$rfile = ; my $socket = &mysocket$host; print $socket "GET...
FtpLocate <= 2.02 (current) Remote Command Execution Exploit
No description provided by source. Alot of code for a cgi | vuln. /str0ke !/usr/bin/perl FtpLocate = 2.02 current remote exploit VERY PRIVATE VERSION DO NOT DISTRIBUTE newbug Tseng at chroot.org sub mysocket my $s=IO::Socket::INET-newPeerAddr = $host, PeerPort = 80, Proto = "tcp" or die "socket: ...
FtpLocate <= 2.02 (current) Remote Command Execution Exploit
Exploit for cgi platform in category web applications ============================================================ FtpLocate newPeerAddr = $host, PeerPort = 80, Proto = "tcp" or die "socket: "; sub ch2hex $chr = $0; $out=""; for$i=0;$i; print "remote file: "; chomp$rfile = ; my $socket =...
FtpLocate 2.02 - current Remote Command Execution
FtpLocate 2.02 - current Remote Command Execution Alot of code for a cgi | vuln. /str0ke !/usr/bin/perl FtpLocate newPeerAddr = $host, PeerPort = 80, Proto = "tcp" or die "socket: "; sub ch2hex $chr = $0; $out=""; for$i=0;$i; print "remote file: "; chomp$rfile = ; my $socket = &mysocket$host; pri...
PHP, ASP, CGI web applications security vulnerabilities
No description provided...
CVE-2005-2195
Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service application crash via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502...
PHP, ASP, CGI web applications security vulnerabilities
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Sybase EAServer buffer overflow
Buffer overflow in TreeAction.do CGI...
CVE-2002-2011
The CVE-2002-2011 entry concerns Faq-O-Matic’s fom.cgi (versions 2.711 and 2.712). The issue is a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the file parameter, potentially enabling/script execution in the victim’s browser. Documented im...
WPS Web-Portal-System v.0.7.0 (wps_shop.cgi) remote commands execution vulnerability
WPS Web-Portal-System v.0.7.0 wpsshop.cgi remote commands execution vulnerability Vendor URL : http://www.pcdoc24.de vendor website seem down Vulnerability : Remote Command Execution Risk : High ================================================================== An attacker may exploit this...
[Full-disclosure] APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce
APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce By Sowhat 2005.07.13 http://secway.org/Advisory/AD20050713.txt Vendor Apple Inc. Product Affected Darwin Streaming Server 5.5 and below for Win32 CVE-ID: CAN-2005-2195 OverView: Darwin Streaming Server is server technology allowing...
FreeBSD : awstats -- remote command execution vulnerability (0f5a2b4d-694b-11d9-a9e7-0001020eed82)
An iDEFENSE Security Advisory reports : Remote exploitation of an input validation vulnerability in AWStats allows attackers to execute arbitrary commands under the privileges of the web server. The problem specifically exists when the application is running as a CGI script on a web server. The...
SiteMinder 5.5 Multiple Script XSS
The remote host is running SiteMinder, an access-management solution from Netegrity / Computer Associates. The installed version of SiteMinder suffers from several cross-site scripting flaws in its 'smpwservicescgi.exe' and 'login.fcc' scripts. An attacker can exploit these flaws to inject...