Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CVE-2008-1960

CVE-2008-1960 describes a Cross-site Scripting (XSS) vulnerability in ContRay 3.x, affecting the CGI script cgi-bin/contray/search.cgi via the search parameter. Remote attackers can inject arbitrary web script or HTML. Per NVD data, the attack is network-delivery with medium complexity and no aut...

Fedora 8 : fedora-ds-admin-1.1.4-1.fc8 (2008-3220)

This release addresses two security vulerabilities in the package: - shell command injection in CGI replication monitor CVE-2008-0892 - unrestricted access to CGI scripts CVE-2008-0893 Fix Description: Remove ScriptAlias for bin/admin/admin/bin - do not use that directory for CGI URIs - use only...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Coppermine: SQL injection...

Fedora 7 : fedora-ds-admin-1.1.4-1.fc7 (2008-3214)

This release addresses two security vulerabilities in the package: - shell command injection in CGI replication monitor CVE-2008-0892 - unrestricted access to CGI scripts CVE-2008-0893 Fix Description: Remove ScriptAlias for bin/admin/admin/bin - do not use that directory for CGI URIs - use only...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Wordpress: different message for wrong username and pasword, weak inicial password generation...

Red Hat Administration Server (redhat-ds-admin) Multiple Remote Vulnerabilities

The remote host is running RedHat or Fedora Directory Server Admin Service. The version of this software installed on the remote host is vulnerable to remote command execution flaw through the argument 'admurl' of the script '/bin/admin/admin/bin/download'. A malicious user could exploit this fla...

[SECURITY] Fedora 8 Update: fedora-ds-admin-1.1.4-1.fc8

Fedora Administration Server is an HTTP agent that provides management feat ures for Fedora Directory Server. It provides some management web apps that can be used through a web browser. It provides the authentication, access cont rol, and CGI utilities used by the console...

[SECURITY] Fedora 7 Update: fedora-ds-admin-1.1.4-1.fc7

Fedora Administration Server is an HTTP agent that provides management feat ures for Fedora Directory Server. It provides some management web apps that can be used through a web browser. It provides the authentication, access cont rol, and CGI utilities used by the console...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Debian Security Advisory DSA 1539-1 (mapserver)

The remote host is missing an update to mapserver announced via advisory DSA 1539-1. OpenVAS Vulnerability Test $Id: deb15391.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1539-1 mapserver Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. mnoGoSearch: crossite scripting in search.php3 via q parameter...

Directory traversal

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing 1 + plus, 2 %2b encode...

CVE-2008-1891

The CVE-2008-1891 entry covers a directory traversal in WEBrick for Ruby (affecting Ruby 1.8.4 and earlier, 1.8.5 before p231, 1.8.6 before p230, 1.8.7 before p22, and 1.9.0 before 1.9.0‑2) when using NTFS/FAT filesystems. An attacker could read arbitrary CGI files by supplying a trailing charact...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

WEBrick Encoded Traversal Arbitrary CGI Source Disclosure

The remote instance of WEBrick, a standard library of Ruby to implement HTTP servers, allows an attacker to view the source of CGI scripts hosted by the affected application by appending to the URL certain characters, such as '+', '%2b', '.', '%2e', or '%20'. Note that successful exploitation may...

CVE-2008-0893

Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions...

Design/Logic Flaw

Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions...