1370 matches found
Basic Analysis and Security Engine Detection
This host is running Basic Analysis and Security Engine BASE. BASE provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
Basic Analysis and Security Engine Detection
This host is running Basic Analysis and Security Engine BASE. BASE provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. OpenVAS Vulnerability Test $Id: basedetect.nasl 5720 2017-03-24 14:15:57Z cfi $ Basic Analysis and Security Engine Detection Authors: Michael...
[20091103] - Core - Front-End Editor Issue
When logged into the front end with Author access, it was possible to replace an article written by another user...
ZABBIX PHP前端多个输入验证漏洞
BUGTRAQ ID: 33965 zabbix是一个CS结构的分布式网络监控系统。 ZABBIX的PHP前端存在多个输入验证错误，远程攻击者可以通过提交恶意请求执行跨站请求伪造攻击、读取敏感信息或完全入侵有漏洞的系统。 1 include/validate.inc.php中没有正确的过滤对calcexp2函数所提交的extlang参数，这可能导致注入并执行任意PHP代码。 2 由于没有检查用户提交请求的有效性，远程攻击者可以通过提交HTTP执行非授权操作。 3...
CVE-2008-5936: Exposure of Sensitive Information to an Unauthorized Actor
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter...
CVE-2008-5883: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list arbitrary directories via a full pathname in the sDir parameter...
CVE-2008-5579: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter...
CVE-2008-5580: Improper Input Validation
mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument...
CVE-2008-3511
Multiple cross-site scripting XSS vulnerabilities in Softbiz Image Gallery Photo Gallery allow remote attackers to inject arbitrary web script or HTML via the 1 latest parameter to a index.php, b images.php, c suggestimage.php, and d imagedesc.php; and the 2 msg parameter to index.php, images.php...
Wordtrans-web exec_wordtrans Function Arbitrary Command Execution
The remote host is running wordtrans-web, a web-based front-end for wordtrans, for translating words. The version of wordtrans-web installed on the remote host fails to sanitize input to the 'advanced' parameter of the 'wordtrans.php' script before using it in an 'passthru' statement to execute P...
Cacti index.php/sql.php Login Action login_username Parameter SQL Injection
The remote host is running Cacti, a web-based front-end to RRDTool for network graphing. The version of Cacti installed on the remote host fails to sanitize user input to the 'loginusername' parameter before using it in the 'authlogin.php' script to perform database queries. Regardless of PHP's...
Cross site scripting
Cross-site scripting XSS vulnerability in boundaryrules.jsp in the Administration Front End for Oracle Enterprise Ultra Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTM...
CVE-2007-2119
CVE-2007-2119 is an XSS vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. The issue affects boundary_rules.jsp and allows remote attackers to inject arbitrary HTML or script via the EXPTYPE parameter. Affected components include the Oracle Database Server variant...
USN-285-1: awstats vulnerability
AWStats did not properly sanitize the 'migrate' CGI parameter. If the update of the stats via web front-end is allowed, a remote attacker could execute arbitrary commands on the server with the privileges of the AWStats server. This does not affect AWStats installations which only build static...
FreeBSD : awstats -- arbitrary command execution vulnerability (2df297a2-dc74-11da-a22b-000c6ec775d9)
OS Reviews reports : If the update of the stats via web front-end is allowed, a remote attacker can execute arbitrary code on the server using a specially crafted request involving the migrate parameter. Input starting with a pipe character '|' leads to an insecure call to Perl's open function an...
awstats -- arbitrary command execution vulnerability
OS Reviews reports: If the update of the stats via web front-end is allowed, a remote attacker can execute arbitrary code on the server using a specially crafted request involving the migrate parameter. Input starting with a pipe character "|" leads to an insecure call to Perl's open function and...
iDEFENSE Security Advisory 06.22.05: IpSwitch WhatsUp Professional 2005 (SP1) SQL Injection Vulnerability
IpSwitch WhatsUp Professional 2005 SP1 SQL Injection Vulnerability iDEFENSE Security Advisory 06.22.05 www.idefense.com/application/poi/display?id=268&type=vulnerabilities June 22, 2005 I. BACKGROUND WhatsUp Professional 2005 SP1 is a network management solution for small and mid sized...
CVE-2005-1250
SQL injection vulnerability in the logon screen of the web front end NmConsole/Login.asp for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the 1 User Name field sUserName parameter or 2 Password sPassword parameter...