[security bulletin] HPSBST02200 SSRT071330 rev.1 - HP StorageWorks Command View Advanced Edition for XP, Local Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00911797 Version: 1 HPSBST02200 SSRT071330 rev.1 - HP StorageWorks Command View Advanced Edition for XP, Local Unauthorized Access NOTICE: The information in this Security Bulletin should be acte...

angellms71-sql.txt

Angel LMS 7.1 Remote SQL Injection by Guns All User Accounts http://Angel Root Directory/section/default.asp?id='%20union%20select%20top%201%20username%20from%20accounts--" Account Passwords http://Angel Root...

Angel LMS 7.1 - Remote SQL Injection

Angel LMS 7.1 Remote SQL Injection by Guns All User Accounts http://Angel Root Directory/section/default.asp?id='20union20select20top20120username20from20accounts--" Account Passwords http://Angel Root Directory/section/default.asp?id='20union20select20top20120password20from20accounts--"...

lmmhi-xss.txt

Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...

Keep track of skipped the Windows System log on automatically-bug warning-the black bar safety net

Windows family all members in the system go to the desktop before, will pop up a user login interface, requires the user to enter a user name and password, only the input is correct before entering the system. This mechanism undoubtedly greatly enhance the security of the system, but for the...

Login Manager Multiple HTML Injections

Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...

Chetcpasswd 2.x: multiple vulnerabilities

From Debian.org: "chetpasswd uses the HTTPXFORWARDEDFOR for authentication purposes.... Obviously, HTTPXFORWARDEDFOR is not a trusted variable, and can be spoofed by any scriptkiddie who can read the man page of wget .... Furthermore, this cgi script doesn't seem to implement any rate limiting fo...

CVE-2006-5909

CVE-2006-5909 concerns Paul Tarjan’s Stanford Conference And Research Forum (SCARF) prior to 20070227. The vulnerability is in generaloptions.php, which does not require admin privilege, allowing remote attackers to reconfigure the application or its user accounts. The available sources (NVD/NVD-...

CVE-2006-5909

generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5597

CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-3939

ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in 1 filter.php, which permits changing the Extensions Mode file type; 2 access.php, which permits changing the Protection Method; 3 edituser.php, which permits adding upload...

CVE-2006-3939

ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in 1 filter.php, which permits changing the Extensions Mode file type; 2 access.php, which permits changing the Protection Method; 3 edituser.php, which permits adding upload...

CVE-2006-3829

Cross-site request forgery CSRF vulnerability in bmc/admin.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a deleteuser action...

USN-290-1: awstats vulnerability

Hendrik Weimer discovered a privilege escalation vulnerability in awstats. By supplying the 'configdir' CGI parameter and setting it to an attacker-controlled directory such as an FTP account, /tmp, or similar, an attacker could execute arbitrary shell commands with the privileges of the web serv...

shadow: Privilege escalation

Background shadow provides a set of utilities to deal with user accounts. Description When the mailbox is created in useradd, the "open" function does not receive the three arguments it expects while OCREAT is present, which leads to random permissions on the created file, before fchmod is...

NeoMail neomail.pl sort Parameter XSS

The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sort' parameter in the 'neomail.pl' script before using it to generate dynamic content. An attacker may be able to exploit this issue to inject...

Security Best Practice: Protection against CIFS Brute-Force Attacks

CIFS is an extension to the Message Block Server SMB protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. In recent years we have witnessed various worms attempting to compromise and spread through Windows machines with weak, default...