CVE-2008-1401

Format string vulnerability in the Net Inspector HTTP server mghttpd in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file...

McAfee Framework _naimcomn_Log远程格式串处理漏洞

BUGTRAQ ID: 28228 McAfee Framework是McAfee ePolicy Orchestrator中所实现的用于创建各种McAfee产品服务的框架。 McAfee Framework所安装的applib.dll库中的logDetail函数缺少必要的格式参数便调用了vsnwprintf，远程攻击者可能利用此漏洞控制服务器。 在McAfee ePolicy Orchestrator中可通过发送单个带有畸形sender、package或computer字段的UDP报文来触发这个漏洞。输出日志文件AgentHOSTNAME.log位于Db文件夹中。 0 McAfee...

F5 BIG-IP Web Management Console XSS

F5 BIG-IP Web Management Console XSS Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP web management interface contains a potentially persistent cross-site scripting vulnerability in the "Console" feature. Output from executed console commands is wrapped in textarea intentional...

CVE-2008-0837

Cross-site scripting XSS vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file...

Cross site scripting

Cross-site scripting XSS vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file...

CVE-2008-0408

HTTP File Server HFS before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication...

Authentication flaw

HTTP File Server HFS before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication...

CVE-2008-0408

HTTP File Server HFS before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication...

CVE-2008-0408

CVE-2008-0408 (HFS) : HTTP File Server versions before 2.2c are vulnerable to a logfile manipulation flaw. Remote attackers can cause arbitrary text to be appended to the server log by sending text encoded in base64 during HTTP Basic Authentication. This is a log forging/injection issue that can ...

Cross site scripting

Cross-site scripting XSS vulnerability in BarracudaDrive Web Server before 3.8 allows remote attackers to inject arbitrary web script or HTML via the URI path in an HTTP GET request, which is activated by administrators viewing log files via the Trace page...

CVE-2007-6211

Send ICMP Nasty Garbage sing on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L output log file option. NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to overrid...

CVE-2007-6211

Send ICMP Nasty Garbage sing on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L output log file option. NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to overrid...

Spoofing

Send ICMP Nasty Garbage sing on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L output log file option. NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to overrid...

CVE-2007-6211

Send ICMP Nasty Garbage sing on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L output log file option. NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to overrid...

DEBIAN-CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...

CVE-2007-4641

Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter, as demonstrated by injecting code into an Apache log file...

Directory traversal

Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter, as demonstrated by injecting code into an Apache log file...

CVE-2007-4641

Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter, as demonstrated by injecting code into an Apache log file...

IPSwitch WS_FTP crossite scripting

Crossite scripting with log file entries in Web interface...

[Full-disclosure] Ipswitch FTP XSS leads to FTP server compromise

VDA Labs Advisory: -------------------------- Ipswitch FTP XSS leads to FTP server compromise. The Vendor has been notified, and given the PoC. Synopsis: ------------ There is XSS vulnerability when the WSFTP server logs client FTP commands. All user commands are logged. When the FTP command is...