CVE-2008-7048

Multiple cross-site scripting XSS vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 txtUsername parameter to registerDo.asp, as invoked from register.asp, or 2 txtRoomName parameter to roomnew.asp. NOTE: these issues might be resultant from...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 txtUsername parameter to registerDo.asp, as invoked from register.asp, or 2 txtRoomName parameter to roomnew.asp. NOTE: these issues might be resultant from...

CVE-2008-7048

Multiple cross-site scripting XSS vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 txtUsername parameter to registerDo.asp, as invoked from register.asp, or 2 txtRoomName parameter to roomnew.asp. NOTE: these issues might be resultant from...

CVE-2008-7048

CVE-2008-7048 concerns NatterChat 1.12 with multiple XSS vulnerabilities (and related SQL injection concerns in some descriptions). The OpenVAS entries confirm vulnerabilities in NatterChat, including XSS and SQLi vectors, specifically via the txtUsername parameter to registerDo.asp (triggered fr...

SQL Injection vulnerabilities in Subdreamer CMS

Background information: This report applies to Subdreamer newest stable release, 2.5.3.2 hotfix5. Subdreamer is a content management system, which is written in PHP and uses MySQL as its database backend. Subdreamer's home page is http://www.subdreamer.com Subdreamer can be integrated with...

postgresql: potential DoS due to conversion functions

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service stack consumption and crash by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding...

HP-UX Update for rpc.mountd HPSBUX00272

Check for the Version of rpc.mountd OpenVAS Vulnerability Test HP-UX Update for rpc.mountd HPSBUX00272 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

USN-761-1: PHP vulnerabilities

It was discovered that PHP did not sanitize certain error messages when displayerrors is enabled, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server...

Code injection

The web login functionality c/portal/login in Novell Teaming 1.0 through SP3 1.0.3 generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

php: XSS via PHP error messages

Cross-site scripting XSS vulnerability in PHP, possibly 5.2.7 and earlier, when displayerrors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208...

Mandriva Update for proftpd MDKA-2007:089 (proftpd)

Check for the Version of proftpd OpenVAS Vulnerability Test Mandriva Update for proftpd MDKA-2007:089 proftpd Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Mandriva Update for rfbdrake MDKA-2007:044 (rfbdrake)

Check for the Version of rfbdrake OpenVAS Vulnerability Test Mandriva Update for rfbdrake MDKA-2007:044 rfbdrake Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for rfbdrake MDKA-2007:044 (rfbdrake)

Check for the Version of rfbdrake OpenVAS Vulnerability Test Mandriva Update for rfbdrake MDKA-2007:044 rfbdrake Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CVE-2009-1273

pamssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

CVE-2009-1273

The CVE-2009-1273 issue affects pam_ssh 1.92 (and possibly other versions) when PAM is built with USE=ssh. The underlying problem is that authentication error messages differ for valid versus invalid usernames, enabling remote users to enumerate usernames. Public references (Fedora advisories FED...

CVE-2009-1273

pamssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

php: XSS via PHP error messages

Cross-site scripting XSS vulnerability in PHP, possibly 5.2.7 and earlier, when displayerrors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208...

CVE-2009-0843

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists...

Design/Logic Flaw

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists...

CVE-2009-0843

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists...