SQL-Ledger验证绕过漏洞

SQL-Ledger是一款开源的ERP系统。 SQL-Ledger验证机制实现存在错误，远程攻击者可以利用漏洞未授权访问应用程序。 SQL-Ledger使用的会话验证存在问题，当用户登录时，会检查密码信息，如果匹配users/members文件中的内容，那么就生成会话ID并在WEB浏览器上处理。验证所需只要简单在COOKIE中指定"sql-ledger-username"名和timestamp值，并且这个值匹配通过GET或POST操作传递的"sessionid"值。username是登录的用户名，timestamp是UNIX时间戳。 SQL-Ledger = 2.6.17...

SAP/DB vserver Detection

SAP/DB vserver, an ERP software, is running on the remote port. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[security bulletin] SSRT5971 rev.0 - HP Tru64 Unix FTP Daemon (ftpd) Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HP SECURITY BULLETIN HPSBTU01227 REVISION: 0 SSRT5971 rev.0 - HP Tru64 Unix FTP Daemon ftpd Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. INITIAL RELEASE: 19 September 2005...

CVE-2003-1383

WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password...

web-erp 0.1.4 database access vulnerability

================================== Security REPORT web-erp 0.1.4 and earlier ================================== Product: web-erp 0.1.4 and earlier Vulnerabilities: full database access Vendor: Phil Daintree http://web-erp.sourceforge.net/ Vendor-Status: E-Mail to "[email protected]" date:...