[ECHO_ADV_36$2006] ExtCalendar <== v2.0 Remote File Include Vulnerabilities

ECHO.OR.ID ECHOADV36$2006 --------------------------------------------------------------------------- ECHOADV36$2006 ExtCalendar == v2.0 Remote File Include Vulnerabilities --------------------------------------------------------------------------- Author : Ahmad Maulana a.k.a Matdhule Date : Jul...

[Full-disclosure] [scip_Advisory 2351] Kyberna AG ky2help various form fields SQL Injection

Kyberna AG ky2help various form fields SQL Injection scip AG Vulnerability ID 2351 07/04/2005 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351 I. INTRODUCTION Kyberna ky2help is a commercial solution for a web-based ticketing and support system. Users are able to send tickets and those are...

SiteBuilder-FX top.php admindir Parameter Remote File Inclusion

The remote host is running SiteBuilder-FX, a web-based design system written in PHP. The version of SiteBuilder-FX installed on the remote host fails to sanitize input to the 'admindir' parameter of the 'admin/top.php' script before using it to include PHP code. Regardless of the setting of PHP's...

Trend Micro Control Manager (TMCM) Persistent XSS Vulnerability

Trend Micro Control Manager TMCM Persistent XSS Vulnerability June 23, 2006 Product Overview: Trend Micro Control Manager is a centralized, web-based outbreak management console designed to simplify enterprise-wide coordination of outbreak security actions and management of Trend Micro products a...

iPlanet.txt

Summary ---------------- Date: 14 Jun 2006 Vendor: Sun Microsystems, Inc. Name: iPlanet Messaging Server Version: 5.2 HotFix 1.16 built May 14 2003 Vuln: msg.conf symlink attack Severity: high Software description ---------------- The iPlanet Messaging Server is a software product that provides a...

Sun iPlanet Messaging Server 5.2 HotFix 1.16 - Root Password Disclosure

Date: 14 Jun 2006 Vendor: Sun Microsystems, Inc. Name: iPlanet Messaging Server Version: 5.2 HotFix 1.16 built May 14 2003 Vuln: msg.conf symlink attack Severity: high Software description ---------------- The iPlanet Messaging Server is a software product that provides a centralized location for...

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

Description Microsoft Windows Media Player is prone to a remote code-execution vulnerability. This vulnerability is related to handling of malicious PNG images. PNG images may be embedded in Windows Media Player skin files. Attackers may be able to exploit this issue by causing the application to...

Ipswitch WhatsUp Professional 2006 - Authentication Bypass

Ipswitch WhatsUp Professional 2006 - Authentication Bypass source: https://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based...

Ipswitch WhatsUp Professional 2006 - Authentication Bypass

source: https://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based administrative interface of the application. This will aid them...

ACal embed/day.php path Parameter Remote File Inclusion

The remote host is running ACal, an open source, web-based event calendar written in PHP. The version of ACal installed on the remote host fails to sanitize user-supplied input to the 'path' parameter of the 'embed/day.php' script before using it in PHP 'include' functions. Provided PHP's...

[SECURITY] [DSA 1052-1] New cgiirc packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1052-1 [email protected] http://www.debian.org/security/ Martin Schulze May 8th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1052-1] New cgiirc packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1052-1 [email protected] http://www.debian.org/security/ Martin Schulze May 8th, 2006 http://www.debian.org/security/faq -...

DSA-1052-1 cgiirc - buffer overflows

Bulletin has no description...

Asterisk Recording Interface (ARI) includes/main.conf Remote Credential Disclosure

The remote host is running Asterisk Recording Interface ARI, a web-based portal for the Asterisk PBX software. The version of ARI installed on the remote host allows an unauthenticated attacker to view its configuration file, which contains sensitive information such as passwords. %NASLMINLEVEL...

X7 Chat help/index.php help_file Parameter Local File Inclusion

The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to properly sanitize input to the 'helpfile' parameter of the 'help/index.php' script before using it in a PHP 'includeonce' function. Provided PHP's...

RechnungsZentrale V2 - SQL injection and Remote PHP inclusion vulnerabilities

---------------------------------------------------------------------------------- - GroundZero Security Research and Software Development 2006 - ---------------------------------------------------------------------------------- - - - Security Advisory regarding RechnungsZentrale v2. - - SQL...

[SECURITY] [DSA 1027-1] New mailman packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1027-1 [email protected] http://www.debian.org/security/ Steve Kemp April 6th, 2006 http://www.debian.org/security/faq -...

TWiki Search.pm shell command injection

Added: 04/06/2006 CVE: CVE-2004-1037 BID: 11674 OSVDB: 11714 Background TWiki is a web-based collaboration platform written in PERL. Problem The Search.pm module does not sufficiently check search strings for illegal characters, allowing remote attackers to execute commands using search strings...

CanfTool11.txt

Cross Site Scripting Attack CanfTool v1.1 ========================================= Description : Conftool is a Web-based online system that was developed to supports many administrative tasks of conferences, workshops and seminars. It can help to make the management of events easier and much mor...

Community Link Pro webeditor login.cgi remote command execution

The remote host is running Community Link Pro, a web-based application written in Perl. The remote version of this software contains a flaw in the script 'login.cgi' which may allow an attacker to execute arbitrary commands on the remote host. OpenVAS Vulnerability Test $Id:...