Absolute Shopping Cart - SQL Injection

Absolute Shopping Cart SQL Injection Vulnerability Vendor: http://www.absoluteshoppingcart.co.uk/Category-195/Shopping-Cart-Demo Author: Gamoscu Site: www.1923turk.biz Site: http://gamoscu.wordpress.com/ Exploit: http://server/latestdetail.asp?prodid=SQL...

Multiple vulnerabilities in XAMPP

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in XAMPP. These are Predictable Resource Location, Information Leakage, Cross-Site Scripting and Directory Traversal vulnerabilities. Predictable Resource Location: There are standard paths to resources in XAMPP, which can b...

NSD version Directive Remote Version Disclosure

The remote host is running Name Server Daemon NSD, an open source DNS server. It is possible to extract the version number of the remote installation by sending a special DNS request for the text 'version.bind' in the domain 'chaos'. C Tenable Network Security, Inc. include"compat.inc"; if...

Discuz!cache.func.php 信息泄漏

漏洞存在于文件\include\cache.func.php里的代码如下: define'DISCUZKERNELVERSION', '6.1.0'; define'DISCUZKERNELRELEASE', '20080418'; ifisset$GET'kernelversion' exit'Crossday Discuz! Boardbr /Developed by Comsenz Inc.br /br /Version: '.DISCUZKERNELVERSION.'br /Release: '.DISCUZKERNELRELEASE;...

PR06-09: BEA Plumtree portal full version disclosure vulnerability

PR06-09: BEA Plumtree portal full version disclosure vulnerability Description: BEA Plumtree portal 6.0 is vulnerable to a full version disclosure vulnerability. The exact version along with the build date is always included at the bottom of every requested HTML page within HTML comments. Date...

Portcullis Security Advisory 06-046

Portcullis Security Advisory Vulnerable System: Visionsoft Audit Vulnerability Title: The VSAOD server discloses its version. Vulnerability discovery and development: Portcullis Security Testing Services discovered this vulnerability during an application assessment. Further research was then...

Flaw in about.r OS and Progress version disclosure

about.r OS and Progress version disclosure. Because of poor security in webutil/about.r it is possible to view the OS and the Progress version of a remote webspeed server. First you have to find the messenger execution url. For example: http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1...

Microsoft .NET Version Information Disclosure

By requesting a non-existent .aspx file on the remote web server, it is possible to obtain the exact version number of the remote .NET framework. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid24243; scriptversion"1.14";...

CVE-2006-5029

SQL injection vulnerability in thread.php in WoltLab Burning Board wBB 2.3.x allows remote attackers to obtain the version numbers of PHP, MySQL, and wBB via the page parameter. NOTE: this issue might be a forced SQL error. Also, the original report was disputed by a third party for 2.3.3 and 2.3...

MS06-033: Vulnerabilities in ASP.NET could allow information disclosure (917283)

The remote host is running a version of the ASP.NET framework that contains a flaw that could allow an attacker to bypass the security of an ASP.NET website by accessing protected objects by their explicit names. Tenable Network Security, Inc. include"compat.inc"; if description scriptid22027;...

Zope < 2.9.4 docutils Information Disclosure

Binary data 3680.prm...

Design/Logic Flaw

SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message...

CVE-2004-2251

The CVE describes the PPTP server in Astaro Security Linux before 4.024 disclosing its version, enabling attackers to tailor attacks against the system. The underlying issue is information disclosure via banner/version reporting rather than an explicit code flaw in core PPTP functionality. The av...

StrongHold < 3.0 build 3015 System File Disclosure

Binary data 1473.prm...

BEA WebLogic < 5.1.0 SP8 Hex-encoded Request JSP Source Disclosure

Binary data 1525.prm...

Web Server Crafted Request Vendor/Version Information Disclosure

The web server running on the remote host appears to be hiding its version or name, which is a good thing. However, using a specially crafted request, Nessus was able to discover the information. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11239; scriptversion...

Oracle Configurator discloses version and host information via "test" argument passed to servlet

Overview A servlet component of Oracle Configurator may post sensitive version and host information to any Web user that makes a crafted request to the server. Description Oracle Configurator is an Internet application used to configure Oracle Application and Database Servers. If a user sends a...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

Microsoft SQL Server UDP Query Remote Version Disclosure

Microsoft SQL server has a function wherein remote users can query the database server for the version that is being run. The query takes place over the same UDP port that handles the mapping of multiple SQL server instances on the same machine. It is important to note that, after Version 8.00.19...