[Full-disclosure] Ipswitch FTP XSS leads to FTP server compromise

VDA Labs Advisory: -------------------------- Ipswitch FTP XSS leads to FTP server compromise. The Vendor has been notified, and given the PoC. Synopsis: ------------ There is XSS vulnerability when the WSFTP server logs client FTP commands. All user commands are logged. When the FTP command is...

[Full-disclosure] EZPhotoSales 1.9.3 Multiple Vulnerabilities

http://www.airscanner.com/security/07080601ezphotosales.htm Airscanner Mobile Security Advisory 07080601: EZPhotoSales 1.9.3 Multiple Vulnerabilities Product: EZPhotoSales 1.9.3 and below Platform: Windows IIS or Apache with PHP Requirements: Windows IIS or Apache with PHP Credits: Seth Fogie...

efsStream.txt

/ ========================================================================== 0-day Alternative File Stream Exploit for EFS Easy Address Book Web Server =========================================================================== EFS' Easy Address Book Web Server is vulnerable to file stream exploi...

EFS Easy Address Book Web Server 1.2 - Remote File Stream

EFS Easy Address Book Web Server 1.2 - Remote File Stream / ========================================================================== 0-day Alternative File Stream Exploit for EFS Easy Address Book Web Server =========================================================================== EFS' Easy...

CVE-2006-4654

Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service crash or "compromise the server" via encoded format string specifiers in the query string...

CVE-2006-4654

CVE-2006-4654 affects Easy Address Book Web Server 1.2. The issue is a remote format-string vulnerability in the query string, allowing an attacker to cause a crash (DoS) or potentially compromise the server. The vulnerability is documented in multiple sources (NVD/NVD listing, CVE listing); expl...

CVE-2006-4654

Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service crash or "compromise the server" via encoded format string specifiers in the query string...

eabweb.txt

Easy Address Book Web Server Format String Vulnerability Software: Easy Address Book Web Server Version: 1.2 Website: http://www.efssoft.com/ Description: Easy Address Book Web Server is a Web Address Book software that allows users to view, search, add, edit, or administer address books easily...

OpenCMS_multiple_vulnerabilities.txt

Multiple access control and input validation vulnerabilities in OpenCMS Open Source Website Content Management System 0. ORIGINAL ADVISORY http://o0o.nu/meder/OpenCMSmultiplevulnerabilities.txt I. BACKGROUND OpenCms is a professional level Open Source Website Content Management System. OpenCms...

Multiple vulnerabilities in OpenCMS

Multiple access control and input validation vulnerabilities in OpenCMS Open Source Website Content Management System 0. ORIGINAL ADVISORY http://o0o.nu/meder/OpenCMSmultiplevulnerabilities.txt I. BACKGROUND OpenCms is a professional level Open Source Website Content Management System. OpenCms...

Security Best Practice: POP3/IMAP Security

Post Office Protocol version 3 POP3 and Internet Messaging Access Protocol version 4 IMAP4 are electronic mail protocols used to retrieve messages stored in e-mail servers.There are several serious security limitations with these protocols that allow malicious attackers to compromise a remote...

Update Protection against Horde Help Viewer Vulnerability

The Horde Application Framework is a modular, general-purpose web application framework written in PHP. A vulnerability has been identified in Horde Application Framework, which may be exploited by attackers to compromise a vulnerable web server...

Update Protection against Multiple SAP Business Connector Vulnerabilities

SAP Business Connector SAP BC is B2B application that enables communication between SAP applications like SAP R/3 and non-SAP applications. Several vulnerabilities have been reported in the SAP BC that can allow for Phishing scams against the SAP BC administrator, disclosure of sensitive...

dotWidget for articles 2.0 - admineditconfig.php Multiple Remote File Inclusions

dotWidget for articles 2.0 - admineditconfig.php Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/18479/info dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize...

PHPBB 2.0.20 persistent issues with avatars

PHPBB 2.0.20 multiple issues with avatars some problems persistently lie in the way it handles remote and uploaded avatars: a remote user can: 1 saturate the server with unuseful files, 'cause phpbb do not delete the previous one when you upload a new avatar 2 use PhpBB installations to launch...

MySQL COM_TABLE_DUMP Information Leakage and Arbitrary command execution.

.oOOo. MySQL COMTABLEDUMP .oOOo. Information Leakage and Arbitrary command execution ============================== - Summary: MySQL Server has an information leakage flaw, if a malicious client sends a specific forged packet. Moreover some particular input can crash the server by overwriting the...

Advanced Guestbook 2.x - 'Addentry.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/17745/info Advanced GuestBook for phpBB is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file...

DbbS 2.0 - Multiple Input Validation Vulnerabilities

DbbS 2.0 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/17559/info DbbS is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and command-execution vulnerabilities. These issues are due to a failure in the application...

DbbS 2.0 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/17559/info DbbS is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and command-execution vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacke...

dotProject 2.0 - modulesprojectsvw_files.php?dPconfig[root_dir] Remote File Inclusion

dotProject 2.0 - modulesprojectsvwfiles.php?dPconfigrootdir Remote File Inclusion source: https://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input...