CVE-2006-0230

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests...

Multiple Symantec Scan Engine network content filtering server security vulnerabilities

Administrative interface passwords are checked on client side, fixed encryption key is used, critical information leak...

Immunity Canvas: MS06_014

Name| ms06014 ---|--- CVE| CVE-2006-0003 Exploit Pack| CANVAS Description| RDS Datastore MS06-014 Notes| CVE Name: CVE-2006-0003 VENDOR: Microsoft MSADV: MS06-014 Repeatability: Infinite client side - no crash MSRC: http://www.microsoft.com/technet/security/Bulletin/MS06-014.mspx CVE Url:...

frontpage -- cross site scripting vulnerability

Esteban Martinez Fayo reports: The FrontPage Server Extensions 2002 included in Windows Sever 2003 IIS 6.0 and available as a separate download for Windows 2000 and XP has a web page /vtibin/vtiadm/fpadmdll.dll that is used for administrative purposes. This web page is vulnerable to cross site...

interspireXSS.txt

I.Vulnerability Interspire TrackPoint NX Cross Site Scripting Vulnerability II.Vendor Interspire www.interspire.com III.Affected Systems - Interspire TrackPoint NX 0.1 IV.About TrackPoint is a web based sales tracking software. V.Description An attacker is able to inject HTML and client-side scri...

FogBugzXSS.txt

I.Vulnerability FogBugz Cross Site Scripting Vulnerability II.Vendor Fog Creek Software www.fogcreek.com III.Affected Systems - FogBugz = 4.029 IV.About FogBugz is a complete web based project management system for software teams. Designed by Joel Spolsky of Joel on Software fame www.fogcreek.com...

Lighthouse CMS 1.1 - Search Cross-Site Scripting

Lighthouse CMS 1.1 - Search Cross-Site Scripting source: https://www.securityfocus.com/bid/15952/info Lighthouse is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to hav...

PunBB IMG Tag Client Side Scripting XSS

The remote web server contains a PHP application that is affected by a cross-site scripting vulnerability. Description : The remote version of PunBB is vulnerable to cross-site scripting flaws because the application does not validate IMG tag. With a specially crafted URL, an attacker can cause...

PunBB IMG Tag Client Side Scripting XSS

The remote version of PunBB is vulnerable to cross-site scripting flaws because the application does not validate IMG tag. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

NetFlow Analyzer 4 XSS Vulnerability

NetFlow Analyzer 4 http://manageengine.adventnet.com/products/netflow/ I encountered Cross Site Scripting Vulnerabilities in some files of the NetFlow Analyzer 4, with this files, sending a specially crafted url you can execute commands in the client side. Proof of Concept...

Gopher <= 3.0.9 (+VIEWS) Remote (Client Side) Buffer Overflow Exploit

No description provided by source. / gopherv3.0.9+: remote client buffer overflow exploit. by: vade79/v9 [email protected] fakehalo/realhalo compile: gcc xgopher-client.c -o xgopher-client syntax: ./xgopher-client port bindshell port The Internet Gopher Client is based on the UMN Gopher/Gopherd 2.3....

nbSMTP <= 0.99 (util.c) Client-Side Command Execution Exploit

Exploit for linux platform in category remote exploits ============================================================= nbSMTP email protected:/home/coki/audi ./nbSMTPfsexp nbSMTP v0.99 remote format string exploit by CoKi Use: ./nbSMTPfsexp options options: -t type of target system -r return addres...

WebEOC privileges are based on client-side authorization

Overview WebEOC ties privileges and roles to client-side resources. If an attacker can access a resource directly, that attacker will be granted all the privileges associated with that resource. Description WebEOC is a web-based crisis information management application that provides functions to...

XOOPS 2.0.11 && Earlier Multiple Vulnerabilities

GulfTech Security Research June 28th, 2005 Vendor : XOOPS URL : http://www.xoops.org/ Version : XOOPS 2.0.11 And Earlier Risk : Multiple Vulnerabilities Description: XOOPS is a very popular dynamic web content management system written in Object Oriented PHP. One of the features of XOOPS is it's...

FlatNuke 2.5.x - help.php Multiple Cross-Site Scripting Vulnerabilities

FlatNuke 2.5.x - help.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/13882/info Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to...

FlatNuke 2.5.x - 'help.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/13882/info Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content...

ImageMagick 6.x - '.PNM' Image Decoding Remote Buffer Overflow

source: https://www.securityfocus.com/bid/13351/info A remotely exploitable client-side buffer-overflow vulnerability affects ImageMagick. This issue occurs because the application fails to properly validate the length of user-supplied strings before copying them into static process buffers. An...

USN-97-1: libxpm vulnerability

Chris Gilbert discovered a buffer overflow in the XPM library shipped with XFree86. If an attacker tricked a user into loading a malicious XPM image with an application that uses libxpm, he could exploit this to execute arbitrary code with the privileges of the user opening the image. These...

CuteNews <= 1.3.6 Multiple XSS

According to its version number, the remote host is running a version of CuteNews that allows an attacker to inject arbitrary script through the variables 'X-FORWARDED-FOR' or 'CLIENT-IP' when adding a comment. On one hand, an attacker can inject a client-side script to be executed by an...

Winace UnAce 1.x - ACE Archive Directory Traversal

Winace UnAce 1.x - ACE Archive Directory Traversal source: https://www.securityfocus.com/bid/12628/info A remotely exploitable client-side directory-traversal vulnerability affects Winace unace. The application fails to properly sanitize file and directory names contained within malicious ACE...