PHP-Calendar configfile变量远程文件包含漏洞

CVECAN ID: CVE-2009-3702 php-Calendar是一款基于WEB的日历事务系统。 PHP-Calendar中存在多个绝对路径遍历漏洞，远程攻击者可以通过在提交给update08.php或update10.ph的configfile参数中的完整路径名导致包含并执行任意本地文件。以下是有漏洞的代码段： 36 elseif!empty$GET'configfile' 37 iffileexists$GET'configfile' 38 requireonce$GET'configfile'; PHP-Calendar 1.1 临时解决方法：...

Trac文本格式报表信息泄露漏洞

CVECAN ID: CVE-2009-4405 Trac是用Python编写的基于Web的事件跟踪系统。 Trac在生成逗号分隔或制表符分隔的文本格式报表时没有正确地强制某些策略，用户无需必要的权限就可以从故障单中访问敏感信息。 Edgewall Software Trac 0.11.6 厂商补丁： Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE...

[SECURITY] Fedora 11 Update: phpldapadmin-1.2.0.4-1.fc11

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

SQL-Ledger 'admin.pl' Empty Credentials

The remote web server is hosting SQL-Ledger, a web-based double-entry accounting system. The installed version does not require credentials to access the administrator interface. Note that the installed version is potentially affected by several other vulnerabilities, though Nessus has not tested...

phpLDAPadmin Detection

The remote host is running phpLDAPadmin, an open source web-based LDAP client written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid43401; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

[ISecAuditors Security Advisories] QuiXplorer <=2.4.1beta Remote Code Execution vulnerability

============================================= INTERNET SECURITY AUDITORS ALERT 2009-003 - Original release date: March 2nd, 2009 - Last revised: December 17th, 2009 - Discovered by: Juan Galiana Lara - Severity: 9/10 CVSS scored ============================================= I. VULNERABILITY...

Active! mail 2003 cross-site scripting vulnerability

Overview Active! mail 2003 from TransWARE Co. contains a cross-site scripting vulnerability. Active! mail 2003 from TransWARE Co. is a web-based email software. Active! mail 2003 contains a cross-site scripting vulnerability. Kenichi Maehashi of CIS RAT at Hosei University reported this...

phpShop Detection

The remote host is running phpShop, a web-based shopping cart application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid43157; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"phpShop...

phpldapadmin Local File Inclusion

Exploit for unknown platform in category web applications ================================= phpldapadmin Local File Inclusion ================================= PHPLDAPADMIN LOCAL FILE INCLUSION author : ipsecs website : http://ipsecs.com Date : December, 10th, 2009 -i- Description "Phpldapadmin i...

JVN#49083120 Active! mail 2003 cross-site scripting vulnerability

Active! mail 2003 from TransWARE Co. is a web-based email software. Active! mail 2003 contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provide...

Vulnerability Note VU#261869

Vulnerability Note VU261869 Clientless SSL VPN products break web browser domain-based security models Overview Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or...

Real World Security: Ed Bellis on Web-based Business and Software Security

Dennis Fisher talks with Ed Bellis, CISO of Orbitz Worldwide, about the security challenges facing a Web-based business, the value of software security initiatives and the joys of compliance in today’s regulatory environment. Read the transcript...

Real World Security – Ed Bellis interview

Dennis Fisher talks with Ed Bellis, CISO of Orbitz Worldwide, about the security challenges facing a Web-based business, the value of software security initiatives and the joys of compliance in today’s regulatory environment. Listen to the podcast: Read the transcript...

GForge Detection

The remote host is running GForge, an open source web-based project-management and collaboration software. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42963; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Mozilla Bugzilla bug别名信息泄漏漏洞

Bugraq ID: 37062 CVE ID：CVE-2009-3386 Mozilla Bugzilla是一款基于Web的BUG跟踪系统。 Mozilla Bugzilla显示"Depends On"或"Blocks"列表中的受限制bugs的别名时存在错误，可导致泄漏敏感信息。 当某个bug属于某个组时，本来它所有信息对此组之外的用户是不可见的。但是存在漏洞可显示非常短的字符串作为快捷方式用于查询bug"Depends On"或"Blocks"列表中的受限制bugs的别名给此组以外的其他用户，导致敏感信息。 Mozilla Bugzilla 3.5.1 Mozilla Bugzill...

Update Protection against HP Power Manager Remote Code Execution

A remote code execution vulnerability exists within HP Power Manager, a web-based application for managing a HP Uninterruptible Power System UPS. The vulnerability is due to insufficient bounds checking in the HP Power Manager while processing URL parameters in the login form of the web based...

Microsoft Security Bulletin MS09-065 - Critical Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947)

Microsoft Security Bulletin MS09-065 - Critical Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution 969947 Published: November 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in the...

HP Power Manager Remote Code Execution

Added: 11/06/2009 CVE: CVE-2009-2685 BID: 36933 OSVDB: 59684 Background HP Power Manager is a web-based application that enables administrators to manage an HP UPS from a browser-based management console. Problem A stack-based buffer overflow in the HP Power Manager management web server allows...

ViewVC Detection

The remote host is running ViewVC, a web-based tool for browsing CVS and Subversion repositories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42347; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

OpenDocMan 1.2.5 xss, SQL injection

Exploit for unknown platform in category web applications =================================== OpenDocMan 1.2.5 xss, SQL injection =================================== Security Advisory : Multiple vulnerabilities in OpenDocMan Overview -------------- OpenDocMan is a free document management system...