CVE-2008-3776

Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2008-3776: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Fujitsu Web-Based Admin View目录遍历漏洞

BUGTRAQ ID: 30780 CNCAN ID：CNCAN-2008082204 Fujitsu Web-Based Admin View不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 提交包含多个"../"字符作为GET请求数据，可导致绕过WEB ROOT限制，以WEB权限查看系统文件内容。 Fujitsu Web-Based Admin View 2.1.2 目前没有解决方案提供： http://www.fujitsu.com/ GET /.././.././.././.././.././.././.././.././.././etc/passw...

fujitsu-traverse.txt

Fujitsu Web-Based Admin View Directory Traversal Vulnerability Version: 2.1.2 on Solaris, Other versions may vulnerable Vulnerability: Directory Traversal Risk: Critical Description: Due to insufficient control of user inputs, Fujitsu Web-based admin view reveals content of files residing in...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

Improper access control

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

Directory traversal

Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Cross site scripting

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3728

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

CVE-2008-3729

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with 1 an IsAdmin=true cookie value or 2 no cookie...

CVE-2008-3728

CVE-2008-3728 affects MicroWorld Technologies MailScan 5.6.a espatch 1. Web-based administration stores sensitive information under the web root with insufficient access control, enabling remote attackers to discover installation path, IP addresses, and error messages by requesting files under LO...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3729

CVE-2008-3729 affects MicroWorld Technologies MailScan Web-Based Administration (MailScan 5.6.a espatch 1). The issue allows remote attackers to bypass authentication and obtain administrative access by sending a direct request with (1) an IsAdmin=true cookie value or (2) no cookie. This is a coo...

CVE-2008-3727: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2008-3726: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion

Binary data 4619.prm...

NCTsoft AudFile.dll ActiveX Control Remote Buffer Overflow Exploit

No description provided by source. ----------------------------------------------------------------------------- NCTsoft AudFile.dll ActiveX Control Remote Buffer Overflow url: http://www.nctsoft.com Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.net This was written for...

@Mail多个本地信息泄漏漏洞

BUGTRAQ ID: 30434 CNCAN ID：CNCAN-2008073104 @Mail是一款基于WEB的邮件服务程序。 @Mail存在两个安全问题，远程攻击者可以利用漏洞获得敏感信息。 问题是webmail/libs/Atmail/Config.php和webmail/webadmin/.htpasswd文件存在全局可读权限，可导致获得数据库用户和密码，或WEBADMIN密码的MD5哈希值。 AtMail @Mail 5.41 目前没有解决方案提供： http://atmail.com/...

[SECURITY] Fedora 9 Update: phpMyAdmin-2.11.8.1-1.fc9

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats a nd ...

Trac Wiki引擎跨站脚本执行漏洞

BUGTRAQ ID: 30400 CVECAN ID: CVE-2008-3328 Trac是用Python编写的基于Web的事件跟踪系统。 Trac的Wiki引擎没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向服务器提交恶意请求执行脚本注入或跨站脚本攻击。 Edgewall Software Trac 0.10.5 Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://ftp.edgewall.com/pub/trac/trac-0.10.5.tar.gz...