PJ CGI Neo Review - Directory Traversal

source: https://www.securityfocus.com/bid/9524/info It has been reported that PJ CGI Neo Review may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory by using '../' character sequences...

CVE-2004-2127

Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the file variable...

2WIRE HomePortal Series - Directory Traversal

2WIRE HomePortal Series - Directory Traversal source: https://www.securityfocus.com/bid/9463/info It has been reported that the software is allegedly prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue i...

vicomsoft rapidcache server 2.02.2.6 - Directory Traversal

vicomsoft rapidcache server 2.02.2.6 - Directory Traversal source: https://www.securityfocus.com/bid/9428/info It has been reported that RapidCache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory using...

Hand-Crafted Software FreeProxy 3.5/3.6 - FreeWeb Directory Traversal

source: https://www.securityfocus.com/bid/9388/info It has been reported that FreeWeb server of FreeProxy may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. The issue may allow a remote attacker to traverse...

CVE-2003-1488

The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...

PHP-Nuke 6.x7.0 Survey Module - SQL Injection

PHP-Nuke 6.x7.0 Survey Module - SQL Injection source: https://www.securityfocus.com/bid/9305/info A vulnerability has been reported to exist in the Survey module of PHP-Nuke that may allow a remote attacker to inject malicious SQL syntax into database queries. The source of this issue is...

Ashley Brown iWeb Server - Encoded Backslash Directory Traversal

Ashley Brown iWeb Server - Encoded Backslash Directory Traversal source: https://www.securityfocus.com/bid/8943/info It has been reported that iWeb Server is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '..%5C' character...

Easy File Sharing Web Server 1.2 - Information Disclosure

source: https://www.securityfocus.com/bid/8777/info Easy File Sharing Web Server has been reported prone to an information disclosure vulnerability. The issue presents itself due to insecure default permissions set on folders that contain Easy File Sharing Web Server log and configuration files. ...

[Full-Disclosure] exploiting fortigate firewall through webinterface

Issue: Several vulnerabilities in web interface of Fortigate firewall of which the most serious one will allow a remote attacker to obtain a username and password of the Fortigate. Release: pre 2.50 maintenance release 4 Fixed in: Fortinet OS 2.50 MR4, available from FTP as of 29 Sept. 2003 Date:...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

WebCalendar 0.9.x Multiple Modules - SQL Injection source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack ...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input...

CVE-2003-0522

Multiple SQL injection vulnerabilities in ProductCart 1.5 through 2 allow remote attackers to 1 gain access to the admin control panel via the idadmin parameter to login.asp or 2 gain other privileges via the Email parameter to Custva.asp...

Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection (2)

Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection 2 source: https://www.securityfocus.com/bid/8159/info It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote...

Coppermine Photo Gallery displayimage.php SQL Injection

The remote host is running Coppermine Gallery - a set of PHP scripts designed to handle galleries of pictures. This product has a vulnerability which allows a remote attacker to execute arbitrary SQL queries. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2002-0300

gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file...

Protegrity Secure.Data for Microsoft SQL Server 2000 contains buffer overflows in extended stored procedures

Overview Protegrity Secure.Data for Microsoft SQL Server 2000 includes several extended stored procedures that contain buffer overflow vulnerabilities. These vulnerabilities could allow a remote attacker to execute arbitrary code, gain access to databases, or cause a denial of service. Descriptio...

Sygate Security Bulletin ID SS20030129-0002

Sygate Security Bulletin Sygate was made aware of an exposure in Sygate Personal Firewall 5.0 and Sygate Security Agent 3.0 on 1/23/2003 by David Fernandez Madrid [email protected]. Sygate Security Bulletin ID ---------------------------- SS20030129-0002 Description ------------ The reporter ...

CVE-2002-2417

acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges...

CVE-2002-2027

Database of Our Owlish Wisdom DOOW 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities...