IBM WebSphere Application Server SIP Logging Information Disclosure Vulnerability

IBM WebSphere Application Server WAS is prone to an information- disclosure vulnerability. A local authenticated attacker can exploit this issue to gain access to sensitive information; this may aid in further attacks. Versions prior to WAS 7.0.0.11 and 6.1.0.31 are vulnerable. OpenVAS...

Advanced Poll Script SQL Injection / Cross Site Scripting

Exploit Title: XSS and Authentication bypass in Advanced Poll Script Date: 26-apr-2010 Author: Sid3^effects Software Link: N/a CVE : Code : XSS and Authentication bypass in Advanced Poll Script Vendor:http://www.2daybiz.com/ Author:Sid3^effects Description : Advanced Poll is a polling system with...

2DayBiz Advanced Poll Script - Cross-Site Scripting / Authentication Bypass

XSS and Authentication bypass in Advanced Poll Script Vendor:http://www.2daybiz.com/ Author:Sid3^effects Description : Advanced Poll is a polling system with powerful administration tool supports both text file and MySQL database. Its features include multiple polls, unlimited options, IP-Logging...

2DayBiz Advanced Poll Script - Cross-Site Scripting Authentication Bypass

2DayBiz Advanced Poll Script - Cross-Site Scripting Authentication Bypass XSS and Authentication bypass in Advanced Poll Script Vendor:http://www.2daybiz.com/ Author:Sid3^effects Description : Advanced Poll is a polling system with powerful administration tool supports both text file and MySQL...

2daybiz Advanced Poll Script XSS and Authentication Bypass

Exploit for php platform in category web applications ========================================================== 2daybiz Advanced Poll Script XSS and Authentication Bypass ========================================================== Description : Advanced Poll is a polling system with powerful...

Format string

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow 1 remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow 2 remote authenticated users t...

CVE-2009-4769

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow 1 remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow 2 remote authenticated users t...

Check accessrights of ps, finger, who, last and /var/log/?tmp*

This plugin uses ssh to Check accessrights of ps, finger, who, last and /var/log/?tmp. Check if ps, finger, who and last is not user executable, check perm 660 for /var/log/?tmp SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2010-0502

iChat Server in Apple Mac OS X Server before 10.6.3, when group chat is used, does not perform logging for all types of messages, which might allow remote attackers to avoid message auditing via an unspecified selection of message type...

Design/Logic Flaw

iChat Server in Apple Mac OS X Server before 10.6.3, when group chat is used, does not perform logging for all types of messages, which might allow remote attackers to avoid message auditing via an unspecified selection of message type...

CVE-2010-0502

The CVE-2010-0502 flaw affects iChat Server on Apple Mac OS X Server, where group-chat logging could exclude certain message types. A design issue allowed remote users to send messages through the server without being fully logged. Affected platforms include Mac OS X Server v10.5.8 and v10.6–v10....

Cross site scripting

Cross-site scripting XSS vulnerability in the Currency Exchange module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to watchdog logging...

Jinais IRC Server 0.1.8 - NULL Pointer PoC

Exploit for multiple platform in category dos / poc ========================================== Jinais IRC Server 0.1.8 - NULL Pointer PoC ========================================== / Jinais IRC Server 0.1.8 - NULL Pointer PoC This PoC will disconnect the affected target IRC server using a NULL...

ClamAV Output Log Handling Format String (CVE-2006-1615)

ClamAV AntiVirus is an open source product that provides anti-virus scanning utilities and an anti-virus library. The program implements extensive logging facilities that are used to record significant events either to a separate log file or using the system logging facility. A format string...

[SECURITY] Fedora 13 Update: sudo-1.7.2p5-1.fc13

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

GLSA-201001-06 : aria2: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201001-06 aria2: Multiple vulnerabilities Tatsuhiro Tsujikawa reported a buffer overflow in DHTRoutingTableDeserializer.cc CVE-2009-3575 and a format string vulnerability in the AbstractCommand::onAbort function in...

Debian DSA-1948-1 : ntp - denial of service

Robin Park and Dmitri Vinokurov discovered that the daemon component of the ntp package, a reference implementation of the NTP protocol, is not properly reacting to certain incoming packets. An unexpected NTP mode 7 packet MODEPRIVATE with spoofed IP data can lead ntpd to reply with a mode 7...

Hardcoded credentials

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

CVE-2010-0660

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

CVE-2010-0643

Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a prox...