279 matches found
MS06-002: Vulnerability in Embedded Web Fonts Could Allow Remote Code Execution (908519)
The remote version of Microsoft Windows contains a flaw in the Embedded Web Font engine. An attacker could execute arbitrary code on the remote host by constructing a malicious web page and entice a victim to visit this web page or by sending a malicious font file. C Tenable Network Security, Inc...
BEA WebLogic Server 8.1 / WebLogic Express Administration Console - Cross-Site Scripting
source: https://www.securityfocus.com/bid/13400/info A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebLogic Express administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically...
CVE-2004-1738
Cross-site scripting XSS vulnerability in page.php in JShop allows remote attackers to inject arbitrary web script or HTML via the xPage parameter...
CVE-2005-0459
phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to selectlang.lib.php, which reveals the path in a PHP error message...
U.S. Robotics USR808054 Wireless Access Point - Web Administration Denial of Service
U.S. Robotics USR808054 Wireless Access Point - Web Administration Denial of Service source: https://www.securityfocus.com/bid/10840/info The USR808054 wireless access point is reported to contain a denial of service vulnerability in its embedded web server. When malicious requests are received b...
Microsoft URLScan 2.5RSA Security SecurID 5.0 - Configuration Enumeration
Microsoft URLScan 2.5RSA Security SecurID 5.0 - Configuration Enumeration source: https://www.securityfocus.com/bid/8419/info A weakness has been discovered in Microsoft URLScan and RSA Security SecurID when used in conjunction on a web server. The problem is said to occur due to the order in whi...
HTTP Method Remote Format String
The remote web server seems to be vulnerable to a format string attack on the method name. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11801; scriptversion"$Revision: 1.1...
Linksys routers unauthorized access
XML parsing hole allows unauthorized web interface access...
CVE-2002-0341
GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter...
CVE-2001-1361
Vulnerability in The Web Information Gateway TWIG 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links...
Directory traversal in Quik-Serv Web Server
No description provided...
ibrow NewsDesk does not securely handle input passed to open()
Overview A vulnerability in ibrow NewsDesk allows an attacker to view files and execute operating system commands with the privileges of the web server. Description ibrow NewsDesk is a Perl CGI script that is designed to create and display news articles on a web site. The code for NewsDesk is...
Re: PHPNuke holes
Another One: /modules.php?op=modload&name=WebLinks&file=index&lop=ratelink&lid=126&ttitle=script Let's party tonite = -- rolphin...
Security hole in kicq
Hi all, there is some security related problem with kicq. The authors were contacted and provided with a suggestion for a patch which should be available soon. I did not find anything on the archive on this, so here we go. kicq is a free icq client clone available at http://kicq.sourceforge.net/...
Дырка в NetScreen
Переполнение буфера при длинной URL в Web-интерфейсе...
ntop.advisory.txt
================================================================================ Hackerslab bugpaper ntop web mode vulnerabliity ================================================================================ Command : /sbin/ntop -w SYSTEM : N/A INFO : ntop - display top network users -w Starts...
CVE-2000-0014
Denial of service in Savant web server via a null character in the requested URL...