Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

ASG-Sentry CGI Detection

The remote CGI script is part of ASG-Sentry, a web-based SNMP network management system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid34394; scriptversion"1.15";...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

快客电邮(QuarkMail)远程命令执行漏洞

快客电邮（QuarkMail）是北京雄智伟业科技公司推出的电子邮件系统，被广泛用于各个领域的电子邮件解决方案，其webmail部分使用perl cgi编写，但是80sec在其系统中发现一个重大的安全漏洞，导致远程用户可以在邮件系统上以当前进程身份执行任意命令，从而进一步控制主机或者系统。 QuarkMail错误地使用perl的open函数以打开文件，实现模板等功能，但是其对用户传入的参数没有做有效的过滤，从而导致一个命令执行漏洞。 登录进入系统之后访问如下URL...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Buffer overflow

Multiple buffer overflows in CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to execute arbitrary code via unspecified vectors...

Null pointer dereference

The CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to cause a denial of service NULL pointer dereference and child process crash via crafted HTTP headers, related to the "error handling mechanism."...

CVE-2008-4403

CVE-2008-4403 affects Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087. The CGI server modules can be exploited remotely to trigger a denial of service via crafted HTTP headers, caused by a NULL pointer dereference in the error handling mechanism. The availab...

CVE-2008-2236

Blosxom has a cross-site scripting (XSS) vulnerability (CVE-2008-2236) in blosxom.cgi before 2.1.2, exploitable via the flav parameter (flavour variable). Public sources consistently state that Blosxom

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2008-4379

Cross-site scripting XSS vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2008-4378

CVE-2008-4378 describes an SQL injection vulnerability in the file report.php of the affected product family “Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier.” The flaw allows remote attackers to inject and execute arbitrary SQL commands through the id parameter. Public references in the connected ...

CVE-2008-4378

SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-4379

CVE-2008-4379 is a cross-site scripting (XSS) vulnerability impacting report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the id parameter, as described in the NVD entry. The reported impact is partial confidenti...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. FCKEditor: arbitrary file upload eCaptcha: crossite scripting...

[SECURITY] Fedora 9 Update: rubygem-rails-2.1.1-2.fc9

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...