516 matches found
CVE-2007-0496
PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website nlws 3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gstrRootDir parameter...
Neon Labs Website <= 3.2 (nl.php g_strRootDir) Remote Inclusion Vuln
Exploit for unknown platform in category web applications ==================================================================== Neon Labs Website = 3.2 nl.php gstrRootDir Remote Inclusion Vuln ====================================================================...
Neon Labs Website 3.2 - 'nl.php?g_strRootDir' Remote File Inclusion
------------------------------------------------------------------------------------------------------------------------ Script:nlws Affected Version:3.2 Downlaoad:http://neonlabs.structum.com.mx/pkgs/nlws3-2.zip...
Neon Labs Website <= 3.2 (nl.php g_strRootDir) Remote Inclusion Vuln
No description provided by source. ------------------------------------------------------------------------------------------------------------------------ Script:nlws Affected Version:3.2 Downlaoad:http://neonlabs.structum.com.mx/pkgs/nlws3-2.zip...
Neon Labs Website 3.2 - nl.php?g_strRootDir Remote File Inclusion
Neon Labs Website 3.2 - nl.php?gstrRootDir Remote File Inclusion ------------------------------------------------------------------------------------------------------------------------ Script:nlws Affected Version:3.2 Downlaoad:http://neonlabs.structum.com.mx/pkgs/nlws3-2.zip...
Neon LibNeon非ASCII字符URI数据远程拒绝服务漏洞
Neon LibNeon存在远程拒绝服务问题。 Neon LibNeon当处理包含非ASCII字符的URI数据时存在漏洞，攻击者可以利用漏洞使使用此库的应用程序崩溃，造成拒绝服务攻击。 Neon Client Library 0.26.2 Neon Client Library 0.26.1 Neon Client Library 0.26 MandrakeSoft Linux Mandrake 2007.0 x8664 MandrakeSoft Linux Mandrake 2007.0 Mandriva Linux可参考如下公告：...
CVE-2007-0157
Array index error in the urilookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service crash via a URI with non-ASCII characters, which triggers a buffer under-read due to a type conversion error tha...
CVE-2007-0157
CVE-2007-0157 affects neon 0.26.0–0.26.2, with a root cause of an array index/buffer under-read in the URI parser when handling non-ASCII characters, potentially on 64-bit platforms. This could allow a remote attacker via a URI to cause a crash (denial of service). Public advisories from openSUSE...
CVE-2006-4951
Neon WebMail for Java before 5.08 allows remote attackers to execute arbitrary Java JSP code by sending an e-mail message with a JSP file attachment, which is stored under the web root with a predictable filename...
CVE-2006-4954
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the inid parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying 1 passwords and 2 permissions, 3 viewing profile settings, and 4 creating and 5 deleting users...
CVE-2006-4952
The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter...
CVE-2006-4955
Directory traversal vulnerability in the downloadfile servlet in Neon WebMail for Java before 5.08 allows remote attackers to read arbitrary files via a .. dot dot sequence in the 1 savefolder and 2 savefilename parameters...
CVE-2006-4956
Cross-site scripting XSS vulnerability in the updateuser servlet in Neon WebMail for Java before 5.08 allows remote attackers to inject arbitrary web script or HTML via the inname parameter, as used by the Name field...
CVE-2006-4953
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the 1 adrsortkey and 2 adrsortkeydesc parameters in the a addrlist servlet, and the 3 sortkey and 4 sortkeydesc parameters in the b maillist servlet...
CVE-2006-4955
CVE-2006-4955 concerns a directory traversal vulnerability in the Neon WebMail for Java downloadfile servlet. The flaw allows remote attackers to read arbitrary files via a .. sequence in the (1) savefolder and (2) savefilename parameters, affecting Neon WebMail for Java prior to version 5.08. Th...
CVE-2006-4951
Neon WebMail for Java before 5.08 allows remote attackers to execute arbitrary Java JSP code by sending an e-mail message with a JSP file attachment, which is stored under the web root with a predictable filename...
CVE-2006-4955
Directory traversal vulnerability in the downloadfile servlet in Neon WebMail for Java before 5.08 allows remote attackers to read arbitrary files via a .. dot dot sequence in the 1 savefolder and 2 savefilename parameters...
CVE-2006-4956
Neon WebMail for Java before 5.08 has a cross-site scripting (XSS) vulnerability in the updateuser servlet. The in_name parameter used for the Name field can be exploited to inject arbitrary script/HTML when the page is rendered. The flaw is documented under CVE-2006-4956 with consistent vendor r...
CVE-2006-4951
Neon WebMail for Java before 5.08 is vulnerable to remote code execution: an attacker can send an email containing a JSP attachment that is stored under the web root with a predictable filename, allowing execution of arbitrary Java (JSP) code on the server. The affected component is Neon WebMail ...
CVE-2006-4954
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the inid parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying 1 passwords and 2 permissions, 3 viewing profile settings, and 4 creating and 5 deleting users...