STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities

STG Security Advisory: SSA-20050113-25 ZeroBoard multiple vulnerabilities Revision 1.1 Date Published: 2004-12-31 KST Last Update: 2005-1-13 Disclosed by SSR Team [email protected] Summary ======= ZeroBoard is one of widely used web BBS applications in Korea. However, an input validation...

IlohaMail Multiple Configuration Files Remote Information Disclosure

The target is running at least one instance of IlohaMail that allows anyone to retrieve its configuration files over the web. These files may contain sensitive information. For example, conf/conf.inc may hold a username / password used for SMTP authentication. %NASLMINLEVEL 70300 This script was...

technote-commandexec.txt

Technote Command Excution Technote Inc. from Korea offers a Site Package which includes a web board. Previous exploit discovered way back on year 2000 focused on a File Disclosure Vulnerability http://www.securityfocus.com/bid/2156/discussion/ However, command execution is also possible using the...

Netbilling NBMEMBER Script - Information Disclosure

Netbilling NBMEMBER Script - Information Disclosure source: https://www.securityfocus.com/bid/11504/info Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and...

Netbilling NBMEMBER Script - Information Disclosure

source: https://www.securityfocus.com/bid/11504/info Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and potentially sensitive configuration information...

Macromedia JRun Server contains an information disclosure vulnerability

Overview An information disclosure vulnerability exists in the Macromedia JRun that may allow an attacker to view the source code of files in the web root directory. Description Macromedia JRun is an application server that works with most popular web servers such as Apache and IIS. Macromedia...

PHP php_variables.c Multiple Variable Open Bracket Memory Disclosure

The remote host is running a version of PHP that is older than 5.0.2 or 4.39. The remote version of this software is affected by a memory disclosure vulnerability in PHPVariables. An attacker may exploit this flaw to remotely read portions of the memory of the httpd process on the remote host...

BBS E-Market Professional bf_130 1.3.0 - Multiple File Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/11191/info BBS E-Market Professional is reported prone to multiple file disclosure vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data. A remote attacker can disclose arbitrary Web-readable files by supplying directo...

bbsEMarket.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 STG Security Advisory: SSA-20040915-07 BBS E-Market Professional multiple vulnerabilities Revision 1.0 Date Published: 2004-09-15 KST Last Update: 2004-09-15 Disclosed by SSR Team [email protected] Abstract ======== BBS E-MarketBobusang in Kore...

SAFE TEAM Regulus 2.2 - Staffile Information Disclosure

source: https://www.securityfocus.com/bid/11132/info SAFE TEAM Regulus is reported prone to an information disclosure vulnerability. It is reported that any user may make a request for the Regulus 'staffile' file hosted on a target server. This file contains a list of Regulus 'staff' users and...

SAFE TEAM Regulus 2.2 - Customer Statistics Information Disclosure

SAFE TEAM Regulus 2.2 - Customer Statistics Information Disclosure source: https://www.securityfocus.com/bid/11134/info Regulus is reported prone to an information disclosure vulnerability. It is reported that it is possible to view a target users connection statistics without requiring valid...

Compulsive Media CNU5 - News.mdb Database Disclosure

Compulsive Media CNU5 - News.mdb Database Disclosure source: https://www.securityfocus.com/bid/11004/info CNU5 is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file 'news.mdb' and gain access to sensitive information including...

Compulsive Media CNU5 - 'News.mdb' Database Disclosure

source: https://www.securityfocus.com/bid/11004/info CNU5 is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file 'news.mdb' and gain access to sensitive information including unencrypted authentication credentials. CNU5 version 1....

12Planet Chat Server Path Disclosure

Binary data 1542.prm...

Zixforum - ZixForum.mdb Database Disclosure

Zixforum - ZixForum.mdb Database Disclosure source: https://www.securityfocus.com/bid/10982/info Zixforum is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file ''ZixForum.mdb' and gain access to sensitive information including...

Zixforum - ZixForum.mdb Database Disclosure

source: https://www.securityfocus.com/bid/10982/info Zixforum is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file ''ZixForum.mdb' and gain access to sensitive information including unencrypted authentication credentials. All...

phpHeaven phpMyChat 0.14.5 - usersL.php3 Multiple SQL Injections

phpHeaven phpMyChat 0.14.5 - usersL.php3 Multiple SQL Injections source: https://www.securityfocus.com/bid/10556/info phpHeaven phpMyChat is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and design flaws. The following specific...

Linksys Web Camera Software 2.10 - 'Next_file' File Disclosure

source: https://www.securityfocus.com/bid/10476/info It is reported that Linksys Web Camera software is prone to a remote file disclosure vulnerability that may allow a remote attacker to disclose sensitive files. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however...

IBM Lotus Domino ?ReadDesign Request Design Element Disclosure

The remote web server allows an attacker to view an XML list of design elements by sending a specially crafted HTTP request to the remote Lotus Domino server: http://target/names.nsf/view?ReadDesign Copyright C 2000 - 2004 Net-Square Solutions Pvt Ltd. By: Hemil Shah Desc: This script will check...

OpenBB 1.0.x - Private Message Disclosure

source: https://www.securityfocus.com/bid/10217/info It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials. This issue might allow an attacker to read arbitrary private messages poste...