CVE-2008-3909

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified requests...

FreeBSD Security Advisory (FreeBSD-SA-04:09.kadmind.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:09.kadmind.asc ADV FreeBSD-SA-04:09.kadmind.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway DSGW web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject...

CVE-2008-2929

The CVE-2008-2929 event concerns multiple XSS vulnerabilities in the adminutil library used by the Directory Server Administration Express and Directory Server Gateway web interfaces. Affected systems include Red Hat Directory Server 7.1 prior to SP7, 8 EL4/EL5, and Fedora Directory Server. The X...

Design/Logic Flaw

Unspecified vulnerability in the DB2 Administration Server DAS in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664...

CVE-2008-3855

Unspecified vulnerability in the DB2 Administration Server DAS in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664...

CVE-2008-3855

Unspecified vulnerability in the DB2 Administration Server DAS in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664...

Red Hat Directory Server多个跨站脚本漏洞

BUGTRAQ ID: 30870 CVE ID: CVE-2008-2929 CNCVE ID：CNCVE-20082929 Red Hat Directory Server是一款LDAPv3兼容的目录服务程序。 Directory Server Administration Express和Directory Server Gateway DSGWWEB接口不正确处理用户提供的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是由于WEB接口不正确解析用户提供的"%"转义字符，可利用这个问题触发跨站脚本攻击，可获得管理员等用户敏感信息。 RedHat Fedora...

CVE-2008-3855: Undefined Security Weakness

Unspecified vulnerability in the DB2 Administration Server DAS in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664...

Moderate: Red Hat Security Advisory: adminutil security update

An updated adminutil package that fixes a security issue is now available for Red Hat Directory Server 8.0. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Red Hat Directory Server is an LDAPv3-compliant server. The adminutil packages is...

Directory traversal

Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Authentication flaw

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with 1 an IsAdmin=true cookie value or 2 no cookie...

Improper access control

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

Cross site scripting

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3728

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/...

CVE-2008-3729

Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with 1 an IsAdmin=true cookie value or 2 no cookie...

CVE-2008-3726

Cross-site scripting XSS vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2008-3728

CVE-2008-3728 affects MicroWorld Technologies MailScan 5.6.a espatch 1. Web-based administration stores sensitive information under the web root with insufficient access control, enabling remote attackers to discover installation path, IP addresses, and error messages by requesting files under LO...

CVE-2008-3729

CVE-2008-3729 affects MicroWorld Technologies MailScan Web-Based Administration (MailScan 5.6.a espatch 1). The issue allows remote attackers to bypass authentication and obtain administrative access by sending a direct request with (1) an IsAdmin=true cookie value or (2) no cookie. This is a coo...