Web sites may transmit authentication tokens unencrypted

Overview Web services that rely on cookies for authentication may be vulnerable to an authentication bypass vulnerability. Some web sites transmit authentication material often cookies without encrypting the entire session, even when the authentication material is initially set over an encrypted...

CVE-2007-2202

PHP remote file inclusion vulnerability in incACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web Services ACVSWS PHP5 ACVSWSPHP5 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the CheminInclude parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in incACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web Services ACVSWS PHP5 ACVSWSPHP5 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the CheminInclude parameter...

inetmedia.txt

Description: ============ Multiple XSS and SQL injection vulnerabilities were found in Inetmedia's web services cityinfo.pl and cityaz.de, which my be exploited by attackers to gain confidential information and/or modify datebase. These flaws are due to PHP programming mistakes in:...

CVE-2006-6430

Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 do not require HTTPS, which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic...

Microsoft Visual Studio WMI Object Code Execution (MS06-073; CVE-2006-4704)

A remote code execution vulnerability exists in Microsoft Visual Studio 2005. Microsoft Visual Studio is a software development product for computer programmers. It centers on an integrated development environment which lets programmers create standalone applications, web sites, web applications,...

CVE-2006-5324

The Web Services Notification WSN security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a username and password, aka PK28374...

New technologies, new threats ten Web2. 0 under attack-vulnerability warning-the black bar safety net

Web2. 0 is the expression of a new generation of network applications fresh terminology. Start.com,Google maps,Writely and MySpace. com is the use of Web2. 0 paradigm. The level of technology advances, to promote the web2. 0 application development. In the network service context, it has...

Update Protection against ASP.NET Information Disclosure Vulnerability (MS06-033)

ASP.NET is collection of technologies within the.NET Framework that enable developers to build Web applications and XML Web Services. An information disclosure vulnerability exists in ASP.Net that could allow an attacker to bypass ASP.Net security and gain unauthorized access to objects in the...

Code injection

Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets WSRP, allows remote attackers to access restricted web resources via crafted URLs...

CVE-2006-0428

BEA WebLogic Portal 8.1 SP3–SP5 is affected by CVE-2006-0428, with exploitation via Web Services Remote Portlets (WSRP). The vulnerability allows remote attackers to access restricted web resources through crafted URLs. Based on the provided documents, the affected component is the WSRP interface...

[SA18593] BEA WebLogic Portal Information Disclosure and Security Bypass

TITLE: BEA WebLogic Portal Information Disclosure and Security Bypass SECUNIA ADVISORY ID: SA18593 VERIFY ADVISORY: http://secunia.com/advisories/18593/ CRITICAL: Moderately critical IMPACT: Security Bypass, Exposure of system information, Exposure of sensitive information WHERE: From remote...

CVE-2006-0201

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipnsuccess.php...

Code injection

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipnsuccess.php...

CVE-2006-0201

The provided connected documents confirm CVE-2006-0201 affects PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier versions. The vulnerability allows remote attackers to inject false payment entries into the log file by sending HTTP POST requests to ipn_success.php, indicating an inpu...

CVE-2006-0202

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

CVE-2006-0201

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipnsuccess.php...

UDDI detection

The tested Web server seems to be friendly to UDDI requests. The server could be potentially offering web services under some other directory we only tested the web root directory OpenVAS Vulnerability Test $Id: uddi.nasl 6046 2017-04-28 09:02:54Z teissa $ Description: UDDI detection Authors: Joh...

Microsoft IIS 5.0 - 500-100.asp Server Name Spoof

Microsoft IIS 5.0 - 500-100.asp Server Name Spoof / ==================================================================================== || || || || || || || || || || ==================================================================================== Name: IIS 5.x and IIS 6.0 Server Name Spoof P...

CVE-2004-2478

The CVE-2004-2478 entry concerns Jetty HTTP Server in affected products (IBM Trading Partner Interchange < 4.2.4; CA Unicenter Web Services Distributed Management