Design/Logic Flaw

An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid 1 perso or 2 aide parameters...

CVE-2006-2689

Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...

CVE-2006-2689

Multiple cross-site scripting XSS vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 debutimage parameter in a article-album.php3, 2 date parameter in b rubrique.php3, and the 3 perso and 4 aide parameters to c an unknown script,...

CVE-2006-2690

An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid 1 perso or 2 aide parameters...

CVE-2006-2689

CVE-2006-2689 describes multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier. The flaws allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) debut_image in article-album.php3, (2) date in rubrique.php3, and (3) perso and (4) a...

CVE-2006-2690

EVA-Web 2.1.2 and earlier contains a path-disclosure vulnerability in an unspecified script (likely index.php). Remote attackers can obtain the full server path via invalid parameters perso or aide. The CVSS v2 base score is 7.8 (HIGH). Exploitation status and concrete remediation are not provide...

EVA-Web 2.1.2 - rubrique.php3?date Cross-Site Scripting

EVA-Web 2.1.2 - rubrique.php3?date Cross-Site Scripting source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage...

EVA-Web 2.1.2 - index.php Multiple Cross-Site Scripting Vulnerabilities

EVA-Web 2.1.2 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacke...

EVA-Web 2.1.2 - article-album.php3?debut_image Cross-Site Scripting

EVA-Web 2.1.2 - article-album.php3?debutimage Cross-Site Scripting source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

EVA-Web 2.1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...

EVA-Web 2.1.2 - 'article-album.php3?debut_image' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...

EVA-Web 2.1.2 - 'rubrique.php3?date' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...

EVA-Web <=2.1.2 vuln.

EVA-Web =2.1.2 vuln. Vuln. discovered by : r0t Date: 27 may 2006 vendor:http://spip-edu.edres74.net/ affected versions:2.1.2 and prior orginal advisory:http://pridels.blogspot.com/2006/05/eva-web-212-vuln.html Vuln. Description: EVA-Web contains a flaw that allows a remote cross site scripting...

CVE-2001-0950

CVE-2001-0950 concerns the ValiCert Enterprise Validation Authority (EVA) Administration Server, version 3.3–4.2.1. The root cause is the use of insufficiently random data: session tokens for HSMs are generated with the C rand() function, and certificate/key generation may rely on /dev/urandom in...

CVE-2001-0949

CVE-2001-0949 affects ValiCert Enterprise Validation Authority (EVA) Administration Server, versions 3.3–4.2.1. The vulnerability is a buffer overflow in the forms.exe CGI program that enables remote attackers to execute arbitrary code by supplying long arguments to a set of parameters (Mode, Cer...

CVE-2001-0949

Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority EVA Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters 1 Mode, 2 CertificateFile, 3 useExpiredCRLs, 4 listenLength, 5 maxThread, 6...

CVE-2001-0947

The CVE-2001-0947 issue affects ValiCert Enterprise Validation Authority (EVA) versions 3.3 through 4.2.1. It allows remote attackers to determine the server’s real pathname by requesting an invalid extension, which causes an error page that reveals the path. The vulnerability is a server-path di...

CVE-2001-0948

CVE-2001-0948 affects ValiCert Enterprise Validation Authority (EVA) versions 3.3–4.2.1 . A cross‑site scripting flaw allows remote attackers to cause arbitrary code execution or display false information by injecting HTML/script into a certificate’s description, which runs when the certificate i...

CVE-2001-0947

Forms.exe CGI program in ValiCert Enterprise Validation Authority EVA 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path...