Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CGI Generic Format String

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. They seem to be vulnerable to a 'format string' attack. By leveraging this issue, an attacker may be able to execute arbitrary code on the remote host subject to the privileges under which the web server...

CGI Generic SSI Injection

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. They seem to be vulnerable to an 'SSI injection' attack. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, In...

CGI Generic Local File Inclusion

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to include a local file and disclose its content. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

HP OpenView Network Node Manager Remote Command Execution (CVE-2005-2773)

HP OpenView Network Node Manager NNM is a solution for the management, maintenance and monitoring of networks and network devices. It is capable of discovering network devices and illustrating the structure of the network in a graphical format. The software suite also identifies possible network...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

openSUSE 10 Security Update : nagios (nagios-6355)

A shell injection bug in nagios' statuswml.cgi CGI script has been fixed. CVE-2009-2288 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update nagios-6355. The text...

CGI Helper 1.0 xss

No description provided by source. CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html Discovered by: Paulo Santos Contact: [email protected] Blog: http://infocampo.wordpress.com The script CGI Helper 1.00 is vulnerable to XSS. Example:...

CGI Helper 1.0 xss

Exploit for unknown platform in category web applications ================== CGI Helper 1.0 xss ================== CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html The script CGI Helper 1.00 is vulnerable to XSS. Example: www.site.com/cgi-bin/helper.cgi XSS:...

CGI Helper 1.00 Cross Site Scripting

CGI Helper 1.00 Download: http://www.sourcecodeonline.com/details/cgihelper.html Discovered by: Paulo Santos Contact: [email protected] Blog: http://infocampo.wordpress.com The script CGI Helper 1.00 is vulnerable to XSS. Example: www.site.com/cgi-bin/helper.cgi XSS:...

Web mirroring

This script makes a mirror of the remote web site and extracts the list of CGIs that are used by the remote host. It is suggested that you allow a long-enough timeout value for this test routine and also adjust the setting on the number of pages to mirror. SPDX-FileCopyrightText: 2009 Renaud...

Trend Micro OfficeScan Server cgiRecvFile Buffer Overflow (CVE-2008-2437)

Trend Micro OfficeScan is a centralized virus and security scan management system. It is meant to consolidate the coordination of security scan actions and the management of Trend Micro virus scanner products installed on nodes of an enterprise network. The product is a central command centre for...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Mandrake Security Advisory MDVSA-2009:246 (php)

The remote host is missing an update to php announced via advisory MDVSA-2009:246. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-on...

SuSE9 Security Update : Perl (YOU Patch Number 12208)

Specially crafted regular expressions could crash perl. CVE-2008-1927 Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : ruby (YOU Patch Number 11442)

The ruby package was updated to fix a denial of service problem in its CGI module when parsing multipart MIME messages. CVE-2006-6303 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

SuSE 11 Security Update : nagios (SAT Patch Number 1105)

A shell injection bug in nagios' statuswml.cgi CGI script has been fixed. CVE-2009-2288 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is...

SuSE9 Security Update : netpbm (YOU Patch Number 11701)

This update fixes a buffer overflow in the RGBA-palette code. The bug can be abused to trigger a denial-or-service attack by feeding untrusted data to 'pnmtopng -alpha' maybe via a remote service like a CGI, mail user agent, etc. The execution of arbitrary code is theoretically possible but...