8966 matches found
AShop Shopping Cart Multiple XSS Vulnerabilities
Ashop Commerce provides a turn-key ecommerce solution with it's revolutionary online store building software. One of the worlds most easy to use web based administrations with award winning features allows the merchant to set up an online store capable of competing with the webs most powerful...
Cacti cmd.php Multiple Parameter SQL Injection Arbitrary Command Execution
The remote host is running Cacti, a web-based, front end to RRDTool for network graphing. The version of Cacti on the remote host does not properly check to ensure that the 'cmd.php' script is being run from a commandline and fails to sanitize user-supplied input before using it in database...
Cacti copy_cacti_user.php template_user Variable SQL Injection
The remote host is running Cacti, a web-based, front end to RRDTool for network graphing. The version of Cacti on the remote host does not properly check whether the 'copycactiuser.php' script is being run from a commandline and fails to sanitize user-supplied input before using it in database...
Jinzora Multiple Script include_path Parameter Remote File Inclusion
The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The installation of Jinzora on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it in the 'jzBackend.php' script to include PHP code. Provide...
DocuWiki With ImageMagick远程命令执行和拒绝服务漏洞
DocuWiki是一款基于web的WIKI程序。 DocuWiki存在多个安全问题，远程攻击者可以利用漏洞进行拒绝服务和命令执行攻击。 问题一是对图像的调整大小处理没有进行限制，可导致拒绝服务攻击。当libGD使用时（默认需要）必须先计算所需RAM，如果没有足够的RAM（一般8到20MB）给php进程使用，那么函数就会放弃。但是如果使用ImageMagick $conf'imconvert'使用时，没有限制存在，允许攻击者利用此特性消耗大量内存，造成拒绝服务攻击。...
Timesheet Login.PHP SQL注入漏洞
Timesheet是一款基于PHP的网络日记程序。 Timesheet不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Login.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Timesheet PHP Timesheet 1.2.1 http://www.timesheetphp.com/...
Microsoft Security Advisory (929433) Vulnerability in Microsoft Word Could Allow Remote Code Execution
Microsoft Security Advisory 929433 Vulnerability in Microsoft Word Could Allow Remote Code Execution Published: December 5, 2006 Top of sectionTop of section Microsoft is investigating a new report of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000, Microsoft Word 2002,...
MattWrighttextcounter.pl远程执行命令漏洞
textcounter.pl是一个由Matt Wright编写的基于Web的记数器脚本，使用比较广泛。 某些早期版本的textcounter.pl脚本实现上存在输入验证漏洞，远程攻击者可以利用此漏洞以httpd进程的权限在主机上执行任意系统命令。问题在于程序脚本没有过滤用户输入中包含的一些特殊字符，远程攻击者可以向$DOCUMENTURI环境变量注入指定的值，脚本在处理的时候就会以Web守护程序的权限（root或nobody）在主机上执行攻击者指定的任意命令。 Matt Wright TextCounter1.2...
Simple File Manager 0.24a Multiple Remote Vulnerabilities
No description provided by source. /\ | flame vrs Simple File Manager =0.24= | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | | Deletion of...
MailEnable NetWebAdmin Unauthorized Access (ME-10019)
The remote version of MailEnable contains a web-based administration tool that allows a user to login with a blank password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid23755; scriptversion"1.19";...
simple file manager 0.24a - Multiple Vulnerabilities
simple file manager 0.24a - Multiple Vulnerabilities /\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | |...
simple file manager 0.24a - Multiple Vulnerabilities
/\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | | Deletion of Arbitrary files | | Modification of Arbitrary...
aigaion-rfi.txt
Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...
CVE-2006-5930: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to 1 basicfunctions.php, or 2 pageactionauthor.php...
Aigaion <= 1.2.1 (DIR) Remote File Include Vulnerabilities
No description provided by source. Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...
CVE-2006-5931: Undefined Security Weakness
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to certain PHP scripts in 1 lib/actions/, 2 lib/displays/, 3...
ContentNow Directory Traversal(upload.php)
Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...
Aigaion 1.2.1 - DIR Remote File Inclusion
Aigaion 1.2.1 - DIR Remote File Inclusion Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...
Aigaion <= 1.2.1 (DIR) Remote File Include Vulnerabilities
Exploit for unknown platform in category web applications ========================================================== Aigaion = 1.2.1 DIR Remote File Include Vulnerabilities ========================================================== Software:Web based bibliography management system Download link:...