889 matches found
SAPwebas.txt
Release Date: 03/01/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at gmail.com Vendor Status: Confirmed Product Overview cited from SAP :...
vulnerability details
Release Date: 03/01/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at gmail.com Vendor Status: Confirmed Product Overview cited from SAP :...
CVE-2006-2035: Undefined Security Weakness
Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL...
Ideal BB.NET 1.3 XSS vuln
Ideal BB.NET 1.3 XSS vuln Vuln. dicovered by : r0t Date: 6 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/ideal-bbnet-13-xss-vuln.html vendor:www.idealscience.com/site/products/idealbb.net.aspx affected version: 1.3 and prior Product Description: It is a powerful bulletin board...
mg2-image.txt
The MG2 Image Gallery system has the ability to make create online galleries. Even password protected once. By manipulating url from a gallery, you are able to list out all pictures in every gallery. Even though they are inside a password protected folder. Sample manipulation could be:...
SEC-20051025-0.txt
SEC-CONSULT Security Advisory 20051025-0 ====================================================================== title: Snoopy Remote Code Execution Vulnerability program: Snoopy PHP Webclient vulnerable version: 1.2 and earlier homepage: http://snoopy.sourceforge.net found: 2005-10-10 by: D. Fabi...
CVE-2005-2874
CVE-2005-2874 affects the Common UNIX Printing System (CUPS) prior to 1.1.23, where the is_path_absolute check in scheduler/client.c can be bypassed by a crafted URL ("..\.."), leading to a denial of service via a tight CPU loop when handling HTTP requests. Public advisories (RHSA-2005:772 / CESA...
[Full-disclosure] User privilege escalation exploit.
Vendor: CyberSource Version: Business Center, Essentials/Small Business, https://businesscenter.cybersource.com/ Severity: Vulnerability allows malicious employees or comprimised accounts to steal money. Vendor Status: Notified, expects to fix issue some time in 2006. Overview: Business Center is...
GLSA-200507-12 : Bugzilla: Unauthorized access and information disclosure
The remote host is affected by the vulnerability described in GLSA-200507-12 Bugzilla: Unauthorized access and information disclosure Bugzilla allows any user to modify the flags of any bug CAN-2005-2173. Bugzilla inserts bugs into the database before marking them as private, in connection with...
DEBIAN-CVE-2005-2148
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the...
squirrelmail -- Several cross site scripting vulnerabilities
A SquirrelMail Security Advisory reports: Several cross site scripting XSS vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4. The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email ...
CVE-2005-1365
Pico Server (pServ)
CVE-2003-1173
CVE-2003-1173 affects Centrinity FirstClass 7.1. The vulnerability allows a remote attacker to access sensitive information by manipulating the URL: append a search, check all search option checkboxes, and leave the text field blank, which returns all files in the targeted directory. The provided...
[SECURITY] [DSA 662-2] New squirrelmail package fixes regression
-------------------------------------------------------------------------- Debian Security Advisory DSA 662-2 [email protected] http://www.debian.org/security/ Martin Schulze March 14th, 2005 http://www.debian.org/security/faq -...
CVE-2005-0622
RaidenHTTPD 1.1.32, and possibly other versions before 1.1.34, allows remote attackers to view the PHP source code via an HTTP GET request for a filename with a trailing 1 . dot or 2 space...
CERN httpd Double Slash Protected Webpage Bypass
The remote web server allows an attacker to access protected web pages by replacing slashes in the URL with '//' or '/./', which is a known problem in older versions of CERN web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17230; scriptversion"1.19";...
CVE-2005-0267
CVE-2005-0267 affects FlatNuke 2.5.1. The vulnerability lies in the url_avatar field of index.php, where specially crafted input containing carriage returns (CR) and line feeds (LF) is interpreted as a sensitive directive, allowing remote attackers to create an administrator account. Some sources...
SquirrelMail may allow execution of arbitrary code
Overview SquirrelMail 1.2.6 may allow remote execution of arbitrary code via URL manipulation. Description From the SquirrelMail webpage:SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render i...
CVE-2005-0152: Undefined Security Weakness
PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."...