Property Site Manager [login bypass ,multiples injection sql & xss (get)]

vendor site:http://www.mginternet.com/ product:Property Site Manager bug:injection sql ,login bypass , xss risk:medium login bypass : just login with : user: 'or''=' passwd: 'or''=' injection sql : http://site.com/asp/detail.asp?l=&p='sql http://site.com/asp/listings.asp?l='sql...

Dragon calendar [ login bypass & injection sql ]

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffie & benjam...

carsite.txt

Car Site Manager injection sql & xss get vendor site:http://www.mginternet.com/ product:Car Site Manager bug:injection sql risk:medium injection sql : http://site.com/csm/asp/detail.asp?l=&p='sql http://site.com/csm/asp/listings.asp?l='sql http://site.com/csm/asp/listings.asp?s=search&typ='sql...

speedwiki20.txt

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

CVE-2006-5741

Multiple cross-site scripting XSS vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via 1 the 404 error page of the Smart Sensor Edge Sensor; 2 the user name for a failed logon, when displayed in the audit journals reviewin...

CVE-2006-5741

Multiple cross-site scripting XSS vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via 1 the 404 error page of the Smart Sensor Edge Sensor; 2 the user name for a failed logon, when displayed in the audit journals reviewin...

Solaris 6 (sparc) : 110971-22

Sun Management Center 3.0: RR Patch for Solaris 2.6. Date this patch was last updated by Sun : Apr/08/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc...

Debian DSA-960-3 : libmail-audit-perl - insecure temporary file creation

The former update caused temporary files to be created in the current working directory due to a wrong function argument. This update will create temporary files in the users home directory if HOME is set or in the common temporary directory otherwise, usually /tmp. For completeness below is a co...

Debian DSA-893-1 : acidlab - missing input sanitising

Remco Verhoef has discovered a vulnerability in acidlab, Analysis Console for Intrusion Databases, and in acidbase, Basic Analysis and Security Engine, which can be exploited by malicious users to conduct SQL injection attacks. The maintainers of Analysis Console for Intrusion Databases ACID in...

Debian DSA-1017-1 : kernel-source-2.6.8 - several vulnerabilities

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2004-1017 Multiple overflows exist in the ioedgepor...

OpenSSH < 4.4 Multiple Vulnerabilities

Binary data 3751.prm...

OpenSSH < 4.4 Multiple Vulnerabilities

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities : - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that...

CVE-2006-4991

RSA Keon Certificate Authority (KeonCA) Manager versions 6.5.1 and 6.6 are affected. The vulnerability allows local privileged users to hide CA activities by tampering auditor logs: (1) modifying or deleting a and its signature in the XML log without triggering the integrity check on the entire ...

CVE-2006-4901

Computer Associates CA eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts and conduct replay attacks by invoking eTSAPISend.exe with the desired arguments...

CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Audit Event System Replay Attack

source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a replay issue. These vulnerabilities occur because the software...

CA eSCC r81.0 eTrust Audit r81.5 - Web Server Full Path Disclosure

CA eSCC r81.0 eTrust Audit r81.5 - Web Server Full Path Disclosure source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - ...

CA eSCC r81.0 eTrust Audit r81.5 - Audit Event System Replay Attack

CA eSCC r81.0 eTrust Audit r81.5 - Audit Event System Replay Attack source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue -...

CA eSCC r81.0 eTrust Audit r81.5 - Arbitrary File Manipulation

CA eSCC r81.0 eTrust Audit r81.5 - Arbitrary File Manipulation source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a...

RSA Keyon Manager audit functionality bypass

Log records blocks are independently signed, making it possible to remove whole block without notice. Records are collected locally before being signed and sent to server, making it possible to tamper log entries...

CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Web Server Full Path Disclosure

source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a replay issue. These vulnerabilities occur because the software...