imgsvrDoS.txt

I have provided the fillowing proof of concept.. Afected-softwear Credit's :n00b. http://freshmeat.net/projects/imgsvr/ Exploit, !/usr/bin/perl Proof of concept. Credit's:to n00b for finding this bug. Afected :ImgSvr.exe Download softwear: http://freshmeat.net/projects/imgsvr/ Crash the server wi...

ImgSvr 0.6.5 - POST Denial of Service

!/usr/bin/perl Proof of concept. Credit's:to n00b for finding this bug. Afected :ImgSvr.exe Download softwear: http://freshmeat.net/projects/imgsvr/ Crash the server with overly long http post request.. Main site of affected product. http://freshmeat.net/projects/imgsvr/ Sending an overly long po...

Cross site scripting

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...

EUVD-2002-2149

Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request...

CVE-2002-2170

The CVE affects BadBlue Enterprise Edition versions 1.7–1.74. The root cause is insufficient authentication when attempts to restrict administrator actions to localhost IP, allowing a remote attacker to trigger arbitrary code execution via an HTTP POST to the dir.hts page on localhost, which can ...

CVE-2002-2170: Undefined Security Weakness

Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request...

Cherokee POST request DoS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to remote denial of service vulnerability when handling a specially-crafted HTTP 'POST' request. An attacker may exploit this flaw to disable this service remotely. OpenVAS...

CVE-2004-2517

The OpenVAS entries confirm a concrete issue in myServer 0.7.1: a remote denial-of-service caused by sending a specially crafted HTTP POST to index.html with View=Logon, leading to the server crash or stop in responding. Affected component is the HTTP POST handling for the Logon operation; the vu...

Hesk 0.920.93 - Session ID Authentication Bypass

Hesk 0.920.93 - Session ID Authentication Bypass source: https://www.securityfocus.com/bid/14879/info Hesk is prone to an authentication bypass vulnerability. Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive...

CVE-2005-2799

Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request...

CVE-2005-2799: Undefined Security Weakness

Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request...

CVE-2005-2383: Undefined Security Weakness

SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request...

CVE-2004-2086

Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an HTTP POST request with a long query parameter...

CVE-2005-1284

The addnew script in Argosoft Mail Server Pro 1.8.7.6 allows remote attackers to create arbitrary accounts, even if "Allow Creation of Accounts From the Web Interface" is disabled, via a direct HTTP POST request...

CVE-2005-0886

Cross-site scripting XSS vulnerability in Invision Power Board 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP POST request...

CVE-2005-0915

Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to 1 ajoutadmin2.php or 2 suppr.php...

CVE-2005-0915

Webmasters-Debutants WD Guestbook 2.8 is affected by an authentication bypass vulnerability. A remote attacker can bypass authentication and perform administrator actions via a direct HTTP POST to (1) ajout_admin2.php or (2) suppr.php. The NVD entry lists a CVSSv2 base score of 7.5 (HIGH) with ne...

CVE-2005-0886

Cross-site scripting XSS vulnerability in Invision Power Board 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP POST request...

CVE-2005-0674

The CVE-2005-0674 entry concerns the paBox 1.6 News module, where a cross-site scripting (XSS) flaw exists in the News module’s handling of the hidden text parameter in an HTTP POST. The connected documents corroborate an XSS issue affecting paBox/Nuke-based deployments (e.g., Nessus plugin refer...

CVE-2005-0674: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the News module for paBox 1.6 allows remote attackers to inject arbitrary web script or HTML via the text hidden parameter in an HTTP POST request...