fetchmail not enforcing TLS for POP3 properly

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

CVE-2007-0360

The CVE-2007-0360 issue is a PHP remote file inclusion in Oreon 1.2.3 RC4 and earlier, where the script lang/index.php unsafely uses the file parameter to include PHP code, enabling remote attackers to execute arbitrary code. Affected product: Oreon (web-based network supervision) prior to the fi...

Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion

------------------------------------------------------------------------------------------------------------------------ Script:oreon-1.2.3-RC4 Downlaoad:http://www.oreon-project.org/...

Oreon <= 1.2.3 RC4 (lang/index.php file) Remote InclusionVulnerability

Exploit for unknown platform in category web applications ====================================================================== Oreon = 1.2.3 RC4 lang/index.php file Remote InclusionVulnerability ======================================================================...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

Joomla OpenSEF Component mosConfig_absolute_path远程文件包含漏洞

Joomla OpenSEF是一款基于PHP的WEB应用程序。 Joomla OpenSEF不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'sef.php'脚本对用户提交的'mosConfigabsolutepath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 OpenSEF Project OpenSEF 2.0-beta3 OpenSEF Project OpenSEF 2.0 RC5 SP2 OpenSEF Project OpenSEF 2.0 RC5 SP1 OpenSEF Proje...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the command parameter...

CVE-2006-1634

CVE-2006-1634 corresponds to a cross-site scripting (XSS) vulnerability in LucidCMS 2.0.0 RC4, exploitable via the command parameter in index.php. The XSS could allow remote attackers to inject arbitrary script/HTML. Affected product is LucidCMS 2.0.0 RC4; root cause is improper handling of user-...

LucidCMS 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/17360/info LucidCMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in t...

LucidCMS 2.0 - index.php Multiple Cross-Site Scripting Vulnerabilities

LucidCMS 2.0 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/17360/info LucidCMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacke...

UltraVNC w/ DSM plugin detection

UltraVNC seems to be running on the remote port. Upon connection, the remote service on this port always sends the same 12 pseudo-random bytes. It is probably UltraVNC with the DSM encryption plugin. This plugin tunnels the RFB protocol into a RC4 encrypted stream. SPDX-FileCopyrightText: 2006...

CVE-2005-4593

PHP remote file inclusion vulnerability in phpDocumentor 1.3.0 rc4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary code via a URL in the 1 FORUMLIB parameter in Documentation/tests/bug-559668.php and 2 the rootdir parameter in docbuilder/filedialog.php...

Miraserver 1.0 RC4 - 'article.php?cat' SQL Injection

source: https://www.securityfocus.com/bid/15960/info Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise o...

Miraserver 1.0 RC4 - 'newsitem.php?id' SQL Injection

source: https://www.securityfocus.com/bid/15960/info Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise o...

Miraserver 1.0 RC4 - index.php?page SQL Injection

Miraserver 1.0 RC4 - index.php?page SQL Injection source: https://www.securityfocus.com/bid/15960/info Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query...

Miraserver 1.0 RC4 - article.php?cat SQL Injection

Miraserver 1.0 RC4 - article.php?cat SQL Injection source: https://www.securityfocus.com/bid/15960/info Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query...

[SA17114] Linux Kernel Two Potential Denial of Service Vulnerabilities

TITLE: Linux Kernel Two Potential Denial of Service Vulnerabilities SECUNIA ADVISORY ID: SA17114 VERIFY ADVISORY: http://secunia.com/advisories/17114/ CRITICAL: Not critical IMPACT: DoS WHERE: Local system OPERATING SYSTEM: Linux Kernel 2.6.x http://secunia.com/product/2719/ DESCRIPTION: Two...

CVE-2005-2614

Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrary commands via a filename containing ".php.rar" or other multiple extensions that include .php...

CVE-2005-2580

CVE-2005-2580 affects MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch. The vulnerability stems from improper sanitization of user input, enabling SQL injection via the Username field in index.php or member.php, via the action parameter in search.php or member.php, or via the polloptions param...

MyBulletinBoard (MyBB) RC4 - 'polloptions' SQL Injection

source: https://www.securityfocus.com/bid/14553/info MyBulletinBoard is prone to multiple SQL injection vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise...