PR06-11: BEA Plumtree portal search facility leaks usernames to unauthenticated users

PR06-11: BEA Plumtree portal search facility leaks usernames to unauthenticated users Description: BEA Plumtree portal 6.0 is vulnerable to username leakage through the search facility. By performing an advanced search, unauthenticated users can enumerate valid usernames with a single HTTP reques...

Cisco Security Advisory: Multiple Vulnerabilities in the Cisco Wireless Control System

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in the Cisco Wireless Control System Advisory ID: cisco-sa-20070412-wcs http://www.cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml Revision 1.0 For Public Release 2007 April 12 1600 UTC GMT -...

GLSA-200701-23 : Cacti: Command execution and SQL injection

The remote host is affected by the vulnerability described in GLSA-200701-23 Cacti: Command execution and SQL injection rgod discovered that the Cacti cmd.php and copycactiuser.php scripts do not properly control access to the command shell, and are remotely accessible by unauthenticated users...

HTTP Upload Tool (download.php) Information Disclosure Vulnerability

No description provided by source. Target: HTTP Upload Tool For PHP 1.0 http://uploadtool.sourceforge.net/ Vulnerability: Information disclosure Description: The download.php file in Upload Tool for PHP neither verifies that a requestor has authenticated, nor performs any sanity checking on the...

HostingController6.1.txt

Hosting Controller 'EnableForum.asp' and 'DisableForum.asp' Scripts Let Remote Users Create or Delete Forums and Virtual Directories advisory : http://www.kapda.ir/advisory-442.html http://securitytracker.com/alerts/2006/Oct/1017103.html SQLInjection, Command Injection ------- KAPDA::59 - Hosting...

barracudaExec.txt

Severity: High - Full system compromise possible Date: 04 August 2006 Discovered by: Matthew Hall [email protected] Credits for original discovery to Greg Sinclair Discovered on: 03 Aug 2006 Summary: Lack of input sanitisation in the Linux based Barracuda spam firewall web interface allows executio...

NotifyLink contains multiple SQL injection vulnerabilities

Overview There are multiple vulnerabilities in NotifyLink that allow unauthenticated remote users to view or modify the contents of the NotifyLink SQL database. Possible modifications include the addition of unauthorized user and administrator accounts. Description Notify Technology NotifyLink...

Multiple SQL Injection Vulnerabilities in Oracle Application Server 9i and RDBMS (#NISR05112003)

NGSSoftware Insight Security Research Advisory Name : Multiple Oracle Application Server SQL Injection Vulnerabilities Systems Affected: All OS platforms; Oracle9i Application Server Release 1 and 2 and RDBMS Severity : High Risk Vendor URL : http://www.oracle.com/ Author : David Litchfield...

CVE-2003-0366

lyskom-server 2.0.7 and earlier allows unauthenticated users to cause a denial of service CPU consumption via a large query...

[AP] Oracle Reports Server Information Disclosure Vulnerability

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - author: skp [email protected] release date: 07/17/2002 homepage: http://sec.angrypacket.com advisory id: 0x0004...

VisualRoute Web Server Detection

VisualRoute is a web-based solution which allows unauthenticated users to perform traceroutes against arbitrary hosts on the Internet. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10744; scriptversion "1.22"; name"english" = "VisualRoute Web Server Detection";...

(SRPRE00002) phpSecurePages 0.23 beta

================================================= Secure Reality Pty Ltd. Security Pre-Advisory 2 SRPRE00002 http://www.securereality.com.au ================================================= Title Remote command execution vulnerabilities in phpSecurePages Released 23/4/2001 This is a pre-release...

Netscape Enterprise Server 3.04.0 - Index Disclosure

Netscape Enterprise Server 3.04.0 - Index Disclosure source: https://www.securityfocus.com/bid/2285/info Netscape Enterprise Server with Web Publishing enabled will disclose the directory listing of the server to unauthenticated users who submit an INDEX request. INDEX / HTTP/1.0...

IBM Scalable POWERparallel (SP) 2.0 - sdrd File Read

IBM Scalable POWERparallel SP 2.0 - sdrd File Read / source: https://www.securityfocus.com/bid/371/info There is a vulnerability in the System Data Repository SDR subsystem. The SDR subsystem is used in IBM SP multi-machine parallel processing environments typically associated with Super Computin...