CVE-2001-1527

easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access...

CVE-2001-1527

The CVE affects easyNews 1.5 and earlier, where administration passwords are stored in cleartext in the file settings.php. This enables local users to obtain passwords and gain access due to improper password storage. The provided documents do not specify a vendor patch or remediation steps; no e...

CVE-2005-2075

PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/dbbackups directory in PHP-Fusion 6.0 ...

CVE-2005-2051

Buffer overflow in the VERITAS Backup Exec Web Administration Console BEWAC 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code...

CVE-2002-1785

Zeus Web Server (Zeus Administration Server) versions 4.0–4.1r2 are affected by an XSS vulnerability in which remote authenticated users can inject arbitrary script or HTML via the section parameter to index.fcgi. The description confirms the vulnerability is an XSS issue without providing detail...

CVE-2005-2051

Buffer overflow in the VERITAS Backup Exec Web Administration Console BEWAC 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code...

CVE-2005-2051

CVE-2005-2051 describes a buffer overflow in the VERITAS Backup Exec Web Administration Console (BEWAC) affecting versions 9.0 build 4367 up to 10.0 revision 5484, enabling remote attackers to execute arbitrary code. The root cause is a buffer overflow in BEWAC’s web interface. Impact per the pro...

compozitSQL.txt

Date: 18:15 05/05/05 Subject: "Compozit Webhosting Panel Administration Vulnerability" Vulnerable version: Compozit 1.0 Description: Compozit is a France Webhosting that use Administration Panel to setup their website online.Have an Control Panel to upload,make a new directory,and modify web page...

CA eTrust Intrusion Detection CPImportKey Function Overflow DoS

The remote host is running CA eTrust Intrusion Detection System, a security solution with intrusion detection, antivirus, web filtering and session monitoring. The remote version of this software is affected by a denial of service vulnerability in the way it uses 'CPImportKey' function. An attack...

xmysqladmin MySQL administration utility symbolic links problem

Unsafe temporary files creation...

PT-2005-2833 · Cutenews · Cutenews

Name of the Vulnerable Software and Affected Versions: CuteNews versions 1.3.6 and earlier Description: A direct code injection issue allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template .tpl file. Recommendation...

[Full-disclosure] [DRUPAL-SA-2005-001] New Drupal release fixes critical security issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2005-001 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2005-001 Date: 2005-jun-01 Security risk: highly critical Impact: system...

[AppSecInc Advisory BEA05-V0101] BEA WebLogic Administration Console login page cross-site scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console login page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0101 http://www.appsecinc.com/resources/alerts/general/BEA-002.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

[AppSecInc Advisory BEA05-V0100] BEA WebLogic Administration Console error page cross-site scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console error page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0100 http://www.appsecinc.com/resources/alerts/general/BEA-001.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

CVE-2005-1747

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the 1 jusername or 2 jpassword parameter...

CVE-2004-2045

The HTTP administration interface on Conceptronic CADSLR1 ADSL router running firmware 3.04n allows remote attackers to cause a denial of service device reboot via an HTTP request with a long username...

CVE-2004-1899

The CVE-2004-1899 entry applies to Monit’s administration interface, affecting versions 1.4 through 4.2. The issue is an off-by-one overflow triggered by a POST containing 1024 bytes, enabling remote attackers to exploit the vulnerability via the admin interface. The connected documents consisten...

CVE-2004-1865

CVE-2004-1865 describes a cross-site scripting vulnerability in the administration panel of bBlog 0.7.2 . The issue allows remote authenticated users with superuser privileges to inject arbitrary web script or HTML via the blog name parameter ($blogname). The provided sources indicate the vulnera...

CVE-2004-2045

The CVE-2004-2045 issue affects the Conceptronic CADSLR1 ADSL router (firmware 3.04n). The HTTP administration interface is vulnerable to a denial-of-service (device reboot) caused by sending an HTTP request with a long username. The root cause is not detailed beyond the long username triggering ...

CVE-2004-1865

Cross-site scripting XSS vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users with superuser privileges to inject arbitrary web script or HTML via a blog name $blogname. NOTE: if administrators are normally allowed to add HTML by other means, e.g. through...