CVE-2007-0116

Digger Solutions Intranet Open Source IOS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb...

CVE-2007-0116

The CVE-2007-0116 issue affects Digger Solutions Intranet Open Source (IOS). The vulnerability arises from storing sensitive information under the web root with insufficient access control, enabling remote attackers to download a database containing passwords by directly requesting data/intranet....

CVE-2007-0116: Undefined Security Weakness

Digger Solutions Intranet Open Source IOS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb...

SOL6924 - Insertion of special characters in URL path circumvents Accessibility Scope and Access Control Lists

It is possible to bypass the Deny list, configured in the Accessibility Scope section located on the Portal Access: Web Applications: Master Group Settings page, by inserting certain special characters into a URL path. In FirePass version 6.0, this issue also applies to the Deny list configured...

Intranet Open Source Remote Password Disclosure "intranet.mdb"

ARIA-SECURITY TEAM Forum: http://aria-security.com Discovered by:Aria-Security Team Type:Remote Password Disclosure Vendor:http://diggersolutions.com/blogs/diggersolutions/default.aspx PoC: http://victim.com/path/data/intranet.mdb Contact: [email protected]...

SOL6922 - Decimal-encoded IP address circumvents Accessibility Scope

It is possible to bypass the Deny list configured in the Accessibility Scope section of the Portal Access: Web Applications: Master Group Settings page using a URL with a decimal-encoded IP address. When you log in to the FirePass Webtop, you can enter a URL into the Webtop Address Bar if the...

CVE-2005-4822

Digger Solutions Intranet Open Source (IOS) 2.7.2 contains an SQL injection in projects/project-edit.asp via the project_id parameter. This allows remote attackers to execute arbitrary SQL commands. Exploitation details are not provided in the documents; no confirmed in-the-wild exploit data is l...

CVE-2005-4822: Undefined Security Weakness

SQL injection vulnerability in projects/project-edit.asp in Digger Solutions Intranet Open Source IOS version 2.7.2 allows remote attackers to execute arbitrary SQL commands via the projectid parameter...

Microsoft Visual Studio “WMI Object Broker”控件代码执行漏洞（MS06-073）

Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具。 Visual Studio的"WMI Object Broker"控件在例程的创建和处理上存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意恶意代码。 Visual Studio所捆绑的WMI Object Broker ActiveX控件允许创建系统上已有的ActiveX控件例程。以这种方式创建的ActiveX对象会绕过ActiveX安全限制，如忽略kill bit和safe for...

Owl Intranet引擎SQL注入漏洞

Owl Intranet Engine是一款基于PHP的开放源代码的发表文件/文档的知识库系统。 Owl Intranet Engine不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可以获得敏感信息。 问题是'lib/owl.lib.php'脚本对用户提交的WEB参数缺少过滤，提交恶意的SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Owl Owl Intranet Engine 0.80 Owl Owl Intranet Engine 0.73 Owl Owl Intranet Engine 0.72 Owl Owl Intranet...

CVE-2006-6264

Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to intranet hosts that use non-RFC1918 addresses, bypassing IPv4 ingress filtering...

CVE-2006-4561

Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's...

CVE-2006-4561: Undefined Security Weakness

Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's...

PT-2006-5354 · Mozilla · Firefox

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox version 1.5.0.6 Description: The issue allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server. This can be achieved by hosting a script on an...

CVE-2006-4560

Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under t...

PT-2006-5353 · Microsoft · Internet Explorer 6

Name of the Vulnerable Software and Affected Versions: Internet Explorer 6 version Description: The issue allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server. This can be achieved by hosting script on an Internet we...

CVE-2006-4212

SQL injection vulnerability in b0zz and Chris Vincent Owl Intranet Engine 0.90 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-4212

SQL injection vulnerability in b0zz and Chris Vincent Owl Intranet Engine 0.90 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-4212

CVE-2006-4212 concerns an SQL injection in Owl Intranet Engine, a PHP-based document management system. The entry states that Owl Intranet Engine 0.90 and earlier is vulnerable and that remote attackers can execute arbitrary SQL commands via unspecified vectors. The connected JVN record notes the...

CVE-2006-4211

CVE-2006-4211 is an XSS vulnerability in Owl Intranet Engine (b0zz and Chris Vincent Owl Intranet Engine) 0.90 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Documented by NVD as a network-accessible XSS with base score 4.3 (...