BarracudaDrive 6.7.2 Cross Site Scripting

Exploit Title : BarracudaDrive Content Management System Multiple XSS Vulnerabilities Author : Manish Kishan Tanwar Vendor : http://barracudadrive.com Software : BarracudaDrive 6.7.2 Date : 15/05/2014 Discovered At : IndiShell LAB indishell.in aka indian cyber army Love to : zero cool,Team...

BarracudaDrive 6.7.1 Cross Site Scripting Vulnerability

BarracudaDrive version 6.7.1 suffers from multiple persistent and reflective cross site scripting vulnerabilities Title : BarracudaDrive Multiple XSS Vulnerabilities Author : Shakeel Bhat SecPod Technologies Pvt. Ltd. http://www.secpod.com Vendor : http://barracudadrive.com Advisory :...

BarracudaDrive 6.7.1 Cross Site Scripting

Title : BarracudaDrive Multiple XSS Vulnerabilities Author : Shakeel Bhat SecPod Technologies Pvt. Ltd. http://www.secpod.com Vendor : http://barracudadrive.com Advisory : http://secpod.org/blog/?p=2309 http://secpod.org/advisories/SecPodAdvistoryBarracudaDrive6.7.1MultXSSVuln.txt Software :...

CVE-2014-2526

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sForumName or 2 sDescription parameter to Forum/manage/ForumManager.lsp; 3 sHint, 4 sWord, or 5 nId parameter to Forum/manage/hangman.lsp; 6 user...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sForumName or 2 sDescription parameter to Forum/manage/ForumManager.lsp; 3 sHint, 4 sWord, or 5 nId parameter to Forum/manage/hangman.lsp; 6 user...

CVE-2014-2526

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sForumName or 2 sDescription parameter to Forum/manage/ForumManager.lsp; 3 sHint, 4 sWord, or 5 nId parameter to Forum/manage/hangman.lsp; 6 user...

CVE-2014-2526

BarracudaDrive (pre-6.7) has multiple XSS vulnerabilities (CVE-2014-2526). The flaws allow remote attackers to inject arbitrary web scripts/HTML via numerous parameters across ForumManager.lsp, hangman.lsp, admin/wizard/setuser.lsp, feedback.lsp, PageManager.lsp, fs, mail/manage/list.lsp, and PAT...

BarracudaDrive多个跨站脚本漏洞

BarracudaDrive运用了网页界面的模式,让我们能轻松的与朋友分享文件。 1通过'/Forum/manage/ForumManager.lsp?nForumId=1'中'sForumName', 'sDescription'参数传递的输入在返回用户前没有正确验证，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 2通过'/Forum/manage/hangman.lsp?nId=1'中'sHint', 'sWord'参数传递的输入在返回用户前没有正确验证，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。...

BarracudaDrive 6.6 Cross Site Scripting

Title : BarracudaDrive Multiple XSS Vulnerabilities Author : Prabhu S Angadi SecPod Technologies Pvt. Ltd. http://www.secpod.com Vendor : http://barracudadrive.com Advisory : http://secpod.org/blog/?p=2158 http://secpod.org/advisories/SecPodBarracudaDriveMultXSSVuln.txt Software : BarracudaDrive...

BarracudaDrive Web Server multiple security vulnerabilities

Directory traversal, script source access, dile deletion, HTML injection, DoS...

Multiple vulnerabilities in BarracudaDrive 3.7.2

Luigi Auriemma Application: BarracudaDrive Web Server http://barracudaserver.com/products/BarracudaDrive/ http://barracudaserver.com/products/HomeServer/ Versions: = 3.7.2 Platforms: Windows Bugs: A directory traversal B scripts source visualization C arbitrary files deleting by users D NULL...

Null pointer dereference

Group Chat in BarracudaDrive Web Server before 3.8 allows remote authenticated users to cause a denial of service crash via a HTTP request to /eh/chat.ehintf/C. that does not contain a Connection ID, which results in a NULL pointer dereference...

CVE-2007-6316

Cross-site scripting XSS vulnerability in BarracudaDrive Web Server before 3.8 allows remote attackers to inject arbitrary web script or HTML via the URI path in an HTTP GET request, which is activated by administrators viewing log files via the Trace page...

Code injection

BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a 1 + plus, 2 . dot, or 3 %80 and similar characters to the file name in the URL...

Directory traversal

Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow 1 remote attackers to read arbitrary files via certain ..\ dot dot backslash sequences in the URL path, or 2 remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ do...

CVE-2007-6314

BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a 1 + plus, 2 . dot, or 3 %80 and similar characters to the file name in the URL...

CVE-2007-6317

Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow 1 remote attackers to read arbitrary files via certain ..\ dot dot backslash sequences in the URL path, or 2 remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\ do...

CVE-2007-6315

Group Chat in BarracudaDrive Web Server before 3.8 allows remote authenticated users to cause a denial of service crash via a HTTP request to /eh/chat.ehintf/C. that does not contain a Connection ID, which results in a NULL pointer dereference...

Cross site scripting

Cross-site scripting XSS vulnerability in BarracudaDrive Web Server before 3.8 allows remote attackers to inject arbitrary web script or HTML via the URI path in an HTTP GET request, which is activated by administrators viewing log files via the Trace page...

CVE-2007-6315

Group Chat in BarracudaDrive Web Server before 3.8 allows remote authenticated users to cause a denial of service crash via a HTTP request to /eh/chat.ehintf/C. that does not contain a Connection ID, which results in a NULL pointer dereference...