PostNuke Phoenix 0.760 RC3 - 'Module' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13076/info A remote cross-site scripting vulnerability affects PostNuke. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. An attacker may leverage this...

paFaq beta4 - answer.php?offset SQL Injection

paFaq beta4 - answer.php?offset SQL Injection source: https://www.securityfocus.com/bid/12582/info paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful...

paFaq beta4 - question.php Multiple SQL Injections

paFaq beta4 - question.php Multiple SQL Injections source: https://www.securityfocus.com/bid/12582/info paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successf...

paFaq beta4 - comment.php Multiple SQL Injections

paFaq beta4 - comment.php Multiple SQL Injections source: https://www.securityfocus.com/bid/12582/info paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successfu...

paFaq beta4 - 'question.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/12582/info paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the...

Microsoft Outlook 2003 - Web Access Login Form Remote URI redirection

source: https://www.securityfocus.com/bid/12459/info A remote URI-redirection vulnerability affects Microsoft Outlook Web Access. This issue occurs because the application fails to properly sanitize URI-supplied data. An attacker may leverage this issue to carry out convincing phishing attacks...

[SA14051] phpPgAds "dest" Parameter HTTP Response Splitting Vulnerability

TITLE: phpPgAds "dest" Parameter HTTP Response Splitting Vulnerability SECUNIA ADVISORY ID: SA14051 VERIFY ADVISORY: http://secunia.com/advisories/14051/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: phpPgAds 2.x http://secunia.com/product/4577/ DESCRIPTION: Te...

[UNIX] AHG EZshopper loadpage.cgi Directory Traversal (.|./ Attack)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

[SA13329] Nuked-Klan "Links" Module Script Insertion Vulnerability

TITLE: Nuked-Klan "Links" Module Script Insertion Vulnerability SECUNIA ADVISORY ID: SA13329 VERIFY ADVISORY: http://secunia.com/advisories/13329/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Nuked-Klan 1.x http://secunia.com/product/1015/ DESCRIPTION:...

LinuxStat 2.x - Directory Traversal

LinuxStat 2.x - Directory Traversal source: https://www.securityfocus.com/bid/11517/info It is reported that LinuxStat is vulnerable to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. By including '../' directory...

[SA12732] AWS MySQLguest Script Insertion Vulnerability

TITLE: AWS MySQLguest Script Insertion Vulnerability SECUNIA ADVISORY ID: SA12732 VERIFY ADVISORY: http://secunia.com/advisories/12732/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MySQLguest http://secunia.com/product/4008/ DESCRIPTION: BliZZard has...

Debian DSA-420-1 : jitterbug - improperly sanitised input

Steve Kemp discovered a security related problem in jitterbug, a simple CGI based bug tracking and reporting tool. Unfortunately the program executions do not properly sanitize input, which allows an attacker to execute arbitrary commands on the server hosting the bug database. As mitigating...

ViewCVS viewcvs.cgi Multiple Parameter XSS

The remote host is running ViewCVS, a tool written in Python to browse CVS repositories via the web. The version of ViewCVS running on the remote host has a cross-site scripting vulnerability. Input to the 'viewcvs' parameter is not properly sanitized. A remote attacker could exploit this by...

Moderate: Red Hat Security Advisory: rsync security update

An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...

RHEL 2.1 / 3 : rsync (RHSA-2004:436)

An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...

Nihuo Web Log Analyzer 1.6 - HTML Injection

Nihuo Web Log Analyzer 1.6 - HTML Injection source: https://www.securityfocus.com/bid/10988/info An HTML injection vulnerability is reported in Nihuo Web Log Analyzer. The problem occurs due to a lack of proper sanitization of user-supplied input data. Attackers may potentially exploit this issue...

Mandrake Linux Security Advisory : rsync (MDKSA-2004:042)

Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, allows remote attackers to write files outside of the module's path. The updated packages provide a patched rsync to correct this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

PHP 4.3.x - Microsoft Windows Shell Escape functions Command Execution

PHP 4.3.x - Microsoft Windows Shell Escape functions Command Execution source: https://www.securityfocus.com/bid/10471/info PHP is reportedly prone to a command execution vulnerability in its shell escape functions. This issue is due to a failure of PHP to properly sanitize function arguments. Th...

osCommerce 2.x - File Manager Directory Traversal

osCommerce 2.x - File Manager Directory Traversal source: https://www.securityfocus.com/bid/10364/info osCommerce has a directory-traversal vulnerability that allows a remote attacker to possibly obtain sensitive information. The software improperly sanitizes user-supplied input and allows '../'...

cPanel 56789 - Resetpass Remote Command Execution

cPanel 56789 - Resetpass Remote Command Execution source: https://www.securityfocus.com/bid/9848/info A potential remote command execution vulnerability has been discovered in the cPanel Application. This issue occurs due to insufficient sanitization of externally supplied data to the script that...