4777 matches found
meth-xss.txt
!/usr/bin/php -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-= ISSUE: SIP protocol's fields such as From, To, Call-ID, User-Agent and many others can carry html tags, wich are shown unfiltered by the Asterisk Log File tools located at...
FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/23575/info FreePBX is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data before using it in dynamically generated content. Attacker-supplied HTML and script code may be executed in the conte...
FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities
FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/23575/info FreePBX is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data before using it in dynamically generated content...
PT-2007-3271
Name of the Vulnerable Software and Affected Versions DirectAdmin versions prior to 1.293 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via http or ftp requests logged in various log files, including /var/log/directadmin/security.log. It also enabl...
sBLOG 0.7.3 Beta (inc/lang.php) Local File Inclusion Exploit
No description provided by source. !/usr/bin/perl sBLOG 0.7.3 Betainc/lang.phpLocal File Inclusion Exploit D.Script: http://sourceforge.net/projects/sblog/ V.Code: ifisset$conflangdefault && fileexists'lang/' . $conflangdefault . '.php' require'lang/' . $conflangdefault . '.php'; Discovered...
Directory traversal
Directory traversal vulnerability in bbcoderef.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log...
CVE-2007-1539
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. dot dot sequence in the modulename parameter, as demonstrated via a static PHP code injection attack in an Apache log file...
CVE-2007-1539
The CVE-2007-1539 entry concerns a Directory traversal vulnerability in the pragmaMX Landkarten 2.1 module, specifically in inc/map.func.php, where an attacker can include arbitrary files through a .. sequence in the module_name parameter. This was demonstrated via a static PHP code injection in ...
Directory traversal
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. dot dot in the settingsskin parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via...
CVE-2007-1524
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. dot dot in the settingsskin parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via...
CVE-2007-1229
Cross-site scripting XSS vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface port 8001/tcp, which is not properly handled in the administrator interface when viewing the log file...
Cross site scripting
Cross-site scripting XSS vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface port 8001/tcp, which is not properly handled in the administrator interface when viewing the log file...
CVE-2007-1225
The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in a URL, which might allow remote attackers to conduct unauthorized activities and avoid detection...
CVE-2007-1229
Cross-site scripting XSS vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface port 8001/tcp, which is not properly handled in the administrator interface when viewing the log file...
Design/Logic Flaw
The Social Bookmarks del.icio.us plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file...
CVE-2006-7027
Microsoft Internet Security and Acceleration ISA Server 2004 logs unusual ASCII characters in the Host header, including the tab, which allows remote attackers to manipulate portions of the log file and possibly leverage this for other attacks...
CVE-2006-7027
Microsoft Internet Security and Acceleration ISA Server 2004 logs unusual ASCII characters in the Host header, including the tab, which allows remote attackers to manipulate portions of the log file and possibly leverage this for other attacks...
CVE-2007-1046
Demtrac allows remote attackers to read log file contents via a direct request for /ancsit.txt...
CVE-2007-1046
CVE-2007-1046 concerns Dem_trac, where remote attackers can read log file contents by issuing a direct request to /anc_sit.txt. The connected documents confirm an information disclosure risk affecting Dem_trac and cite this exact vulnerability across NVD and CVE records. The root cause is imprope...