1051 matches found
CVE-2010-5064
CVE-2010-5064 pertains to Virtual War (aka VWar) 1.6.1 R2, where multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via user-input fields such as Additional Information in challenge.php, Additional Information or Contact information i...
PT-2012-1319
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue concerns the createRandomPassword function, which uses a limited range of values for the seed argument in the PHP mt srand function. This limitation makes it easier for remote attacke...
PT-2012-1317
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various fields, including the...
PT-2012-1489
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by providing a large integer in the ratearticleselect parameter. This is related to the...
CVE-2010-5066: Undefined Security Weakness
The createRandomPassword function in includes/functionscommon.php in Virtual War aka VWar 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mtsrand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack...
CVE-2010-5067: Undefined Security Weakness
Virtual War aka VWar 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie...
CVE-2010-5065: Undefined Security Weakness
popup.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action...
CVE-2010-5063: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in article.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the ratearticleselect parameter...
PT-2012-1320
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to bypass timeout and logout actions, retaining access for a long period. This is possible because the software uses static session cookies that depend only on...
PT-2012-1316
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the ratearticleselect parameter in the "article.php" file. Recommendations For Virtual War aka VWar...
CVE-2010-5279: Undefined Security Weakness
article.php in Virtual War aka VWar 1.6.1 R2 allows remote attackers to cause a denial of service memory consumption via a large integer in the ratearticleselect parameter...
CVE-2010-5064: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Virtual War aka VWar 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via 1 the Additional Information field to challenge.php, the 2 Additional Information or 3 Contact information field to joinus.php, 4 the War Report fie...
PT-2012-1318
Name of the Vulnerable Software and Affected Versions Virtual War aka VWar version 1.6.1 R2 Description The issue allows remote attackers to bypass intended member restrictions and read news posts. This is achieved by modifying the newsid parameter in a "printnews" action. Recommendations For...
JBoss DeploymentFileRepository WAR Deployment
require 'msf/core' class Metasploit4 /JBoss/ include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo = superupdateinfoinfo, 'Name' = 'JBoss DeploymentFileRepository WAR Deployment via JMXInvokerServlet', 'Description' = %q This module can be used to execute a payload...
War FTP Daemon 'USER' and 'PASS' Remote Format String Vulnerability
War FTP is prone to format string vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
War FTP Daemon Format String
Exploit Title: War FTP Daemon Remote Format String Vulnerability crash: http://img826.imageshack.us/img826/6222/69004160.png Date: 2012-08-30 Author: coolkaveh [email protected] https://twitter.com/coolkaveh Vendor Homepage: http://www.warftp.org Version: War FTP Daemon 1.82 RC 11 Tested o...
War FTP Daemon 1.82 RC 11 Daemon Remote Format String Vulnerability
Exploit for windows platform in category remote exploits Exploit Title: War FTP Daemon Remote Format String Vulnerability crash: http://img826.imageshack.us/img826/6222/69004160.png Date: 2012-08-30 Author: coolkaveh email protected https://twitter.com/coolkaveh Vendor Homepage:...
WarFTP Daemon 1.82 RC 11 - Remote Format String
WarFTP Daemon 1.82 RC 11 - Remote Format String Exploit Title: War FTP Daemon Remote Format String Vulnerability crash: http://img826.imageshack.us/img826/6222/69004160.png Date: 2012-08-30 Author: coolkaveh [email protected] https://twitter.com/coolkaveh Vendor Homepage:...
WarFTP Daemon 1.82 RC 11 - Remote Format String
Exploit Title: War FTP Daemon Remote Format String Vulnerability crash: http://img826.imageshack.us/img826/6222/69004160.png Date: 2012-08-30 Author: coolkaveh [email protected] https://twitter.com/coolkaveh Vendor Homepage: http://www.warftp.org Version: War FTP Daemon 1.82 RC 11 Tested o...
Authentication flaw
McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation RMI interface, which allows remote attackers to execute arbitrary code via a crafted .war file...