FreeBSD : ImageMagick -- PSD handler heap overflow vulnerability (597e2bee-68ea-11d9-a9e7-0001020eed82)

An iDEFENSE Security Advisory reports : Remote exploitation of a buffer overflow vulnerability in The ImageMagick's Project's ImageMagick PSD image-decoding module could allow an attacker to execute arbitrary code. Exploitation may allow attackers to run arbitrary code on a victim's computer if t...

phpGroupWare, eGroupWare: PHP script injection vulnerability

Background phpGroupWare and eGroupWare are web based collaboration software suites. Description The XML-RPC implementations of phpGroupWare and eGroupWare fail to sanitize input sent to the XML-RPC server using the "POST" method. Impact A remote attacker could exploit the XML-RPC vulnerability to...

CVE-2005-2175

The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

CVE-2005-2175

The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

CVE-2005-2176

Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

CVE-2005-2176

Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

CVE-2005-2176

Novell NetMail is vulnerable to an issue where HTML in an attachment is processed automatically without prompting the user to save or open it, enabling potential web-based attacks and cookie theft. The provided sources (NVD/CVE record) confirm the description but do not specify affected versions,...

punBB < 1.2.6 profile.php $temp Parameter SQL Injection (deprecated)

Binary data 3058.prm...

YaPiG Password Protected Directory Bypass

The remote host is running YaPiG, a web-based image gallery written in PHP. The remote version of this software contains a flaw that can let a malicious user view images in password protected directories. Successful exploitation of this issue may allow an attacker to access unauthorized images on...

Nabopoll survey.inc.php path Parameter Remote File Inclusion

The remote host is running nabopoll, a web-based voting / survey software for PHP and MySQL. The installed version of nabopoll allows remote attackers to control the 'path' parameter used when including PHP code in the script 'survey.inc.php'. By leveraging this flaw, an attacker is able to view...

WebCalendar Detection

This script detects whether the remote host is running WebCalendar and extracts version numbers and locations of any instances found. WebCalendar is an open source web calendar application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18572;...

Echo Security Advisory 2005.21

--------------------------------------------------------------------------- ECHOADV21$2005 MUltiple Vulnarable In ActiveBuyAndSell --------------------------------------------------------------------------- Author: Dedi Dwianto Date: June, 24th 2005 Location: Indonesia, Jakarta Web:...

Ipswitch WhatsUp Professional 2005 SP1 - 'login.asp' SQL Injection

source: https://www.securityfocus.com/bid/14039/info WhatsUp Professional is prone to an SQL injection vulnerability affecting its Web-based front end. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'login.asp' script before using it in an SQL...

Cacti: Several vulnerabilities

Background Cacti is a complete web-based frontend to rrdtool. Description Cacti fails to properly sanitize input which can lead to SQL injection, authentication bypass as well as PHP file inclusion. Impact An attacker could potentially exploit the file inclusion to execute arbitrary code with the...

CVE-2002-1733

Technical details are not publicly available in the provided documents for CVE-2002-1733. Monitor for updates; no confirmed affected products, versions, or fixes are specified in the supplied sources.

CVE-2002-1733

Cross-site scripting XSS vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML via a message board post...

paFAQ 1.0 Beta 4 Multiple Vulnerabilities

The remote host is running paFAQ, a web-based FAQ system implemented in PHP / MySQL. The installed version of paFAQ on the remote host suffers from several vulnerabilities. Among the more serious are a SQL injection vulnerability that enables an attacker to bypass admin authentication and a...

ViRobot Linux Server addschup Multiple Overflows

The remote host is running ViRobot Linux Server, a commercial anti- virus product for Linux. According to its banner, the installed version of ViRobot Linux Server suffers from a remote buffer overflow vulnerability in its web-based management interface. By passing specially crafted data through...

eGroupWare: XSS and SQL injection vulnerabilities

Background eGroupWare is a suite of web-based group applications including calendar, address book, messenger and email. Description Multiple SQL injection and cross-site scripting vulnerabilities have been found in several eGroupWare modules. Impact An attacker could possibly use the SQL injectio...

CVE-2005-0112

The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point AP 1.00.08, and possibly earlier versions before 1.03.07A, allows remote attackers to bypass authentication and obtain sensitive information by directly accessing the 1 config.bin 2 profile.wlp?PN=ggg or 3...