3637 matches found
DevTrack Web Service UserName Field SQL Injection
The remote host is running DevTrack, a defect and project tracking tool. The DevTrack Web Services component installed on the remote host contains an ASP script that fails to sanitize user-supplied input to the 'UserName' parameter before using it in a database query. An unauthenticated, remote...
FreeBSD : awstats -- arbitrary code execution vulnerability (e86fbb5f-0d04-11da-bc08-0001020eed82)
An iDEFENSE Security Advisory reports : Remote exploitation of an input validation vulnerability in AWStats allows remote attackers to execute arbitrary commands. The problem specifically exists because of insufficient input filtering before passing user-supplied data to an eval function. As part...
DMCounter092b.txt
Script: DMCounter Version: 0.9.2-b Language: PHP Problem: Remote File Include Vendor: http://sourceforge.net/projects/dmcounter Discovered by: beford Description ============= Statistics software based on PHP which does not require any database support but just uses flat files. Daily + monthly...
Command injection
Adobe Graphics Server 2.0 and 2.1 formerly AlterCast and Adobe Document Server ADS 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the 1 saveContent...
CVE-2006-1182
Adobe Graphics Server 2.0 and 2.1 formerly AlterCast and Adobe Document Server ADS 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the 1 saveContent...
Tolva.txt
Script: Tolva PHP website system Version: 0.1.0 Language: PHP Official Website: http://sourceforge.net/projects/twebs Problem: Remote File Include Discovered by: beford Description: ============ A complete collection of php scripts that work tightly together to create a highly customizable, dynam...
HP Security Digests - HP-UX security bulletins digest
HP Support Information Digests =============================================================================== o Security Bulletin Digest Split ------------------------------ The security bulletins digest has been split into multiple digests based on the operating system HP-UX, MPE/iX, and HP...
If the other is a BT-vulnerability warning-the black bar safety net
Use the security policy prohibits local host is connected to each other in any port! Then allow others to connect their 8 0 port! The debug/ftp/tftp/its/start/net/net1/echo/edit to remove it! Local only provides a web service! Shut down/filter all ports,and now get this host is a shell, there are...
[Full-disclosure] iDEFENSE Security Advisory 08.09.05: AWStats ShowInfoURL Remote Command Execution Vulnerability
AWStats ShowInfoURL Remote Command Execution Vulnerability iDEFENSE Security Advisory 08.09.05 www.idefense.com/application/poi/display?id=290&type=vulnerabilities August 09, 2005 I. BACKGROUND AWStats is a free tool that generates web, streaming, ftp or mail server statistics, graphically. It ca...
[Full-disclosure] ASP.NET RCP/Encoded Web service DOS
ASP.NET RCP/Encoded Web service DOS http://www.spidynamics.com/spilabs/advisories/aspRCP.html Release Date: July 11, 2005 Severity: High System Affected IIS Servers exposing ASP.NET Web services that consume arrays in RCP/Encoded mode Applications using System.Xml.Serialization to consume untrust...
security flaw
Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...
CVE-2005-1207
Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters...
Microsoft ISA Server HTTP/HTTPS Service Basic Auth Information Disclosure Vulnerability
Description Microsoft Internet Security and Acceleration ISA server is prone to an information disclosure vulnerability. Reports indicate that the issue manifests when an ISA server is publishing a Web service that has Basic authentication enabled, but the Web publishing rules that process the...
CVE-2004-1815
Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service memory consumption...
CVE-2004-1815
CVE-2004-1815 affects ColdFusion MX 6.0/6.1 and JRun 4.0 where a SOAP web service expecting an array of objects as an argument can trigger a denial of service via memory exhaustion. The connected advisory (CPAI-2004-114) indicates the issue involves how Apache Axis handles SOAP arrays within requ...
CVE-2004-1816: Undefined Security Weakness
Unknown vulnerability in Sun Java System Application Server 7.0 Update 2 and earlier, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service memory consumption...
CVE-2004-1815: Undefined Security Weakness
Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service memory consumption...
Lotus Domino Server Web Service NRPC Authentication Format String DoS
Binary data 2870.prm...
MailEnable Authorization Header Buffer Overflow
This module exploits a remote buffer overflow in the MailEnable web service. The vulnerability is triggered when a large value is placed into the Authorization header of the web request. MailEnable Enterprise Edition versions prior to 1.0.5 and MailEnable Professional versions prior to 1.55 are...