Brio Unix Directory Traversal

The Brio web application interface has a directory traversal in the component SPDX-FileCopyrightText: 2003 Chris Foster Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only v. 1.00 last upda...

AWStats < 6.3 'configdir' Parameter Arbitrary Command Execution Vulnerability - Active Check

AWStats is prone to a command execution vulnerability. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:awstats:awstats";...

BasiliX SQL Injection Vulnerability

The remote web server contains PHP scripts that are prone to SQL injection attacks. Description : The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions are potentially vulnerable to SQL injection attacks depending on the version of PHP installed...

CWmail.exe Information Disclosure / Privilege Escalation Vulnerability

The CWMail.exe exists on this webserver. Some versions of this file are vulnerable to remote exploit. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PHP-Nuke security vulnerability (bb_smilies.php)

The remote host seems to be vulnerable to a security problem in PHP-Nuke bbsmilies.php. The vulnerability is caused by inadequate processing of queries by PHP-Nuke SPDX-FileCopyrightText: 2001 SecuriTeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

Horde Chora < 1.2.2 RCE Vulnerability - Active Check

Horde Chora is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

PHP3 Physical Path Disclosure Vulnerability

PHP3 will reveal the physical path of the webroot when asked for a non-existent PHP3 file if it is incorrectly configured. Although printing errors to the output is useful for debugging applications, this feature should not be enabled on production servers. OpenVAS Vulnerability Test $Id:...

Apache HTTP Server /server-info Accessible (HTTP)

Requesting the URI /server-info provides a comprehensive overview of the server configuration. SPDX-FileCopyrightText: 2005 StrongHoldNet SPDX-FileCopyrightText: New NASL / detection code since 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

SilverStream directory listing

SilverStream directory listings are enabled. An attacker may use this problem to gain more knowledge on this server and possibly to get files you would want to hide. Reference : http://online.securityfocus.com/archive/101/144786 OpenVAS Vulnerability Test $Id: silverstreamdirlisting.nasl 8023...

Oracle XSQLServlet XSQLConfig.xml File

It is possible to read the contents of the XSQLConfig.xml file which contains sensitive information. OpenVAS Vulnerability Test $Id: oracle9iXSQLServletXSQLConfig.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Oracle XSQLServlet XSQLConfig.xml File Authors: Matt Moore Copyright: Copyright C...

PGPMail.pl detection

The 'PGPMail.pl' CGI is installed. Some versions up to v1.31 a least of this CGI do not properly filter user input before using it inside commands. This would allow a cracker to run any command on your server. Note: OpenVAS just checked the presence of this CGI but did not try to exploit the flaw...

cgi.rb

The 'cgi.rb' CGI is installed. Some versions is vulnerable to remote denial of service. By sending a specially crafted HTTP POST request, a malicious user can force the remote host to consume a large amount of CPU ressources. Warning : OpenVAS solely relied on the presence of this CGI, it did not...

WebAPP Apage.CGI remote command execution flaw

Due to a lack of user input validation, an attacker can exploit the OpenVAS Vulnerability Test $Id: webappapagecmdexe.nasl 6053 2017-05-01 09:02:51Z teissa $ Description: WebAPP Apage.CGI remote command execution flaw Authors: David Maciejak Copyright: Copyright C 2005 David Maciejak This program...

CuteNews index.php XSS

The remote web server contains a PHP script that is prone to cross-site scripting attacks. Description : The version of CuteNews installed on the remote host is vulnerable to a cross-site-scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce a user to browse to ...

DB4Web directory traversal

It is possible to read any file on your system through the DB4Web software. OpenVAS Vulnerability Test $Id: db4webdirtrav.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: DB4Web directory traversal Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is free software; y...

SunSolve CD CGI user input validation

Sunsolve CD CGI scripts does not validate user input. Crackers may use them to execute some commands on your system. Note: OpenVAS did not try to perform the attack. OpenVAS Vulnerability Test $Id: sscdinput.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: SunSolve CD CGI user input validatio...

Bugzilla remote arbitrary command execution

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to arbitrary commands execution flaws due to a lack of sanitization of user-supplied data in processbug.cgi OpenVAS Vulnerability Test $Id: bugzillaremoteexec.nasl 8023 2017-12-07 08:36:26Z teissa $ Descriptio...

vpasswd.cgi

The 'vpasswd.cgi' CGI is installed. Some versions do not properly check for special characters and allow a cracker to execute any command on your system. Warning : OpenVAS solely relied on the presence of this CGI, it did not determine if you specific version is vulnerable to that problem OpenVAS...

Synchrologic User account information disclosure

The remote host seems to be running Synchrologic Email Accelerator Synchrologic is a product which allows remote PDA users to synch with email, calendar, etc. If this server is on an Internet segment as opposed to internal, you may wish to tighten the access to the aggregate.asp page. The server...

Remote Code Execution in Knowledge Builder

KnowledgeBuilder is a feature-packed knowledge base solution CGI suite. A vulnerability in this product may allow a remote attacker to execute arbitrary commands on this host. SPDX-FileCopyrightText: 2003 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are...