HP Systems Insight Manager Namazu lang Parameter Traversal Arbitrary File Access

The remote host appears to be running HP Systems Insight Manager SIM, a unified infrastructure management tool. The version of HP SIM on the remote host includes a version of the search engine Namazu that reportedly fails to validate user input to the 'lang' parameter of the 'namazucgi' script. A...

PHP Doc System index.php show Parameter Local File Inclusion

The remote host is running PHP Doc System, a modular, PHP-based system for creating documentation. The version of PHP Doc System installed on the remote host fails to sanitize user input to the 'show' parameter of the 'index.php' script before using it in a PHP 'include' function. An...

cgi.rb

The 'cgi.rb' CGI is installed. Some versions is vulnerable to remote denial of service. By sending a specially crafted HTTP POST request, a malicious user can force the remote host to consume a large amount of CPU ressources. Warning : OpenVAS solely relied on the presence of this CGI, it did not...

PGPMail.pl detection

The 'PGPMail.pl' CGI is installed. Some versions up to v1.31 a least of this CGI do not properly filter user input before using it inside commands. This would allow a cracker to run any command on your server. Note: OpenVAS just checked the presence of this CGI but did not try to exploit the flaw...

http TRACE XSS attack

Debugging functions are enabled on the remote HTTP server. The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting...

Oracle 9iAS Dynamic Monitoring Services

In a default installation of Oracle 9iAS, it is possible to access the Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted. OpenVAS Vulnerability Test $Id: oracle9iapachedms.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Oracle 9iAS Dynamic Monitoring...

CuteNews index.php XSS

The remote web server contains a PHP script that is prone to cross-site scripting attacks. Description : The version of CuteNews installed on the remote host is vulnerable to a cross-site-scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce a user to browse to ...

PHP3 Physical Path Disclosure Vulnerability

PHP3 will reveal the physical path of the webroot when asked for a non-existent PHP3 file if it is incorrectly configured. Although printing errors to the output is useful for debugging applications, this feature should not be enabled on production servers. OpenVAS Vulnerability Test $Id:...

CVSTrac history.c history_update function overflow

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to the historyupdate function in history.c that may allow an attacker to cause a buffer overflow and execute arbitrary code on the remote system. OpenVAS has...

SilverStream directory listing

SilverStream directory listings are enabled. An attacker may use this problem to gain more knowledge on this server and possibly to get files you would want to hide. Reference : http://online.securityfocus.com/archive/101/144786 OpenVAS Vulnerability Test $Id: silverstreamdirlisting.nasl 8023...

Oracle XSQLServlet XSQLConfig.xml File

It is possible to read the contents of the XSQLConfig.xml file which contains sensitive information. OpenVAS Vulnerability Test $Id: oracle9iXSQLServletXSQLConfig.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Oracle XSQLServlet XSQLConfig.xml File Authors: Matt Moore Copyright: Copyright C...

SunSolve CD CGI user input validation

Sunsolve CD CGI scripts does not validate user input. Crackers may use them to execute some commands on your system. Note: OpenVAS did not try to perform the attack. OpenVAS Vulnerability Test $Id: sscdinput.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: SunSolve CD CGI user input validatio...

WebAPP Apage.CGI remote command execution flaw

Due to a lack of user input validation, an attacker can exploit the OpenVAS Vulnerability Test $Id: webappapagecmdexe.nasl 6053 2017-05-01 09:02:51Z teissa $ Description: WebAPP Apage.CGI remote command execution flaw Authors: David Maciejak Copyright: Copyright C 2005 David Maciejak This program...

Bugzilla remote arbitrary command execution

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to arbitrary commands execution flaws due to a lack of sanitization of user-supplied data in processbug.cgi OpenVAS Vulnerability Test $Id: bugzillaremoteexec.nasl 8023 2017-12-07 08:36:26Z teissa $ Descriptio...

vpasswd.cgi

The 'vpasswd.cgi' CGI is installed. Some versions do not properly check for special characters and allow a cracker to execute any command on your system. Warning : OpenVAS solely relied on the presence of this CGI, it did not determine if you specific version is vulnerable to that problem OpenVAS...

DB4Web directory traversal

It is possible to read any file on your system through the DB4Web software. OpenVAS Vulnerability Test $Id: db4webdirtrav.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: DB4Web directory traversal Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is free software; y...

Synchrologic User account information disclosure

The remote host seems to be running Synchrologic Email Accelerator Synchrologic is a product which allows remote PDA users to synch with email, calendar, etc. If this server is on an Internet segment as opposed to internal, you may wish to tighten the access to the aggregate.asp page. The server...

phpAdsNew Multiple Vulnerabilities (Mar 2005) - Active Check

phpAdsNew is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBProArcade index.php SQL Injection

One of the ibProArcade SPDX-FileCopyrightText: 2004 Ami Chayun Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.16086";...

Brio Unix Directory Traversal

The Brio web application interface has a directory traversal in the component SPDX-FileCopyrightText: 2003 Chris Foster Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only v. 1.00 last upda...