CVE-2007-3424

The affected software is WebAPP (Web-app.org) prior to version 0.9.9.7. The vulnerability lies in the moveim function of cgi-bin/cgi-lib/instantmessage.pl, which uses the tocat parameter as a subdirectory name when moving an instant message. The underlying impact is described as unknown in the so...

CVE-2007-3423

CVE-2007-3423 affects WebAPP (web-app.org) WebAPP versions before 0.9.9.7. The vulnerable component is cgi-bin/cgi-lib/instantmessage.pl, where the From field of an instant message is used as the beginning of the .dat filename when the imview2 or imview3 function reads messages from an internal I...

CVE-2007-3422

WebAPP (web-app.org) before 0.9.9.7 is affected by CVE-2007-3422. The getcgi function in cgi-bin/cgi-lib/subs.pl parses query strings containing (1) non‑printing characters, (2) certain printing characters not common in URLs, or (3) invalid URL encoding sequences. Impact is stated as unknown with...

CVE-2007-3420

The CVE concerns WebAPP (web-app.org) prior to version 0.9.9.7, where the Random Cookie Password feature in the loaduser function (cgi-bin/cgi-lib/subs.pl) fails to clear four cookies (username, password, usertheme, userlang) for unauthorized users. This creates a potential, described as having u...

CVE-2007-3419

The CVE-2007-3419 entry concerns the editprofile3 function in cgi-bin/cgi-lib/user.pl of WebAPP (web-app.org) prior to version 0.9.9.7. The issue involves improper validation of seven data files (themes.dat, languages.dat, profession.dat, gen.dat, marstat.dat, states.dat, ages.dat) when saving me...

CVE-2007-3418

The CVE-2007-3418 issue affects WebAPP (web-app.org) prior to version 0.9.9.7. The displaypost function in cgi-bin/cgi-lib/forum_display.pl does not display usernames with real names, which enables remote authenticated users to impersonate other users. Affected component: forum_display.pl. Root c...

CVE-2007-3417

CVE-2007-3417 covers multiple XSS vulnerabilities in the WebAPP web-app.org CGI module: cgi-bin/cgi-lib/search.pl, where a non-sanitized search string is echoed into an HREF attribute by process_search or show_recent_searches. The issue affects WebAPP prior to version 0.9.9.7 and allows remote at...

CVE-2007-3423

cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the 1 imview2 or 2 imview3 function reads a an internal IM, or a message from a b guest or c removed member, which has unknown impact and...

CVE-2007-3421

CVE-2007-3421 concerns web-app.org WebAPP prior to 0.9.9.7, where multiple features (login, admin profile edit, reminder, edit profile, profile view, gallery view, gallery comment, and gallery feedback) do not verify presence of users in memberlist.dat. The root cause is a missing user verificati...

CVE-2007-3242

The Menu Manager Mod for 1 web-app.net WebAPP aka WebAPP NE 0.9.9.3.3 through 0.9.9.8, and 2 web-app.org WebAPP before 0.9.9.6, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the titles of items in a personal menu...

Code injection

The Menu Manager Mod for 1 web-app.net WebAPP aka WebAPP NE 0.9.9.3.3 through 0.9.9.8, and 2 web-app.org WebAPP before 0.9.9.6, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the titles of items in a personal menu...

CVE-2007-3242

The CVE-2007-3242 entry concerns the Menu Manager Mod for WebAPP WebAPP NE (versions 0.9.9.3.3–0.9.9.8) and WebAPP.org WebAPP before 0.9.9.6. The vulnerability allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters into the titles of items in a personal ...

Menu Manager Mod for WebAPP - No Input Filtering

There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading ...

webapp-exec.txt

There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading ...

MolyX BOARD 2.5.0 - 'index.php?lang' Local File Inclusion

=============== MolyX BOARD 2.5.0 Local File Inclusion ==== Possibly other versions =============== Vulnerability found by MurderSkillz ============================================== =============== d0rk "Powered by MolyX BOARD 2.5.0" ========================================= ===============...

Fixed in Apache Tomcat 5.5.18, 5.0.SVN

Moderate: Cross-site scripting CVE-2006-7195 The implicit-objects.jsp in the examples webapp displayed a number of unfiltered header values. This enabled a XSS attack. These values are now filtered. Affects: 5.0.0-5.0.30, 5.5.0-5.5.17...

PT-2007-1472 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.17 Description: A cross-site scripting XSS issue exists due to unfiltered header values in the implicit-objects.jsp file of the examples webapp, allowing...

CVE-2006-7190

Cross-site scripting XSS vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the viewnews function, related to use of doubbctopic instead of doubbc...

Code injection

Multiple unspecified vulnerabilities in web-app.net WebAPP have unknown impact and attack vectors, described as "having other security issues too, not as bad as letting users take over your admin account, but bad too."...

CVE-2007-1828

Multiple cross-site scripting XSS vulnerabilities in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the QUERYSTRING corresponding to drop downs or 2 various forms...