Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. pMachinePro: HTTP Response Splitting...

Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling

Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling source: https://www.securityfocus.com/bid/29112/info Microsoft Internet Explorer is prone to a weakness that can facilitate cross-site scripting attacks. The issue occurs because the application fails to sufficiently sanitize...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. pMachinePro: HTTP Response Splitting...

Vulnerability in pMachinePro

Здравствуйте 3APA3A! Сообщаю вам о найденной мною HTTP Response Splitting уязвимости в pMachinePro. Уязвимость в скрипте sitelaunch.php в параметре go. Которая может быть использована в частности для проведения Cross-Site Scripting атаки. XSS:...

Attack Technique: File Download Injection

File Download Injection ======================= Affects most web application platforms, including Java, .NET, PHP, Cold Fusion. This attack involves the use of header injection, particularly the Content-Disposition header, to subvert HTTP responses from trusted domains. Attackers can use this...

GLSA-200803-19 : Apache: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-19 Apache: Multiple vulnerabilities Adrian Pastor and Amir Azam ProCheckUp reported that the HTTP Method specifier header is not properly sanitized when the HTTP return code is '413 Request Entity too large' CVE-2007-6203...

GLSA-200803-18 : Cacti: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-18 Cacti: Multiple vulnerabilities The following inputs are not properly sanitized before being processed: 'viewtype' parameter in the file graph.php, 'filter' parameter in the file graphview.php, 'action' and 'loginusernam...

Apache: Multiple vulnerabilities

Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Adrian Pastor and Amir Azam ProCheckUp reported that the HTTP Method specifier header is not properly sanitized when the HTTP return code is "413 Request Entity too large" CVE-2007-6203. The...

[ GLSA 200803-18 ] Cacti: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

openSUSE 10 Security Update : cacti (cacti-5043)

This update fixes the following vulnerabilities : - multiple XSS vulnerabilities - path disclosure - multiple SQL injections - HTTP response splitting on very old PHP instances %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Fedora 7 : cacti-0.8.7b-1.fc7 (2008-1737)

XSS vulnerabilities Path disclosure vulnerabilities SQL injection vulnerabilities HTTP response splitting vulnerabilities bug0000855: Unnecessary and faulty DEF generation for CF:AVERAGE bug0001083: Small visual fix for Cacti in 'View Cacti Log File' bug0001089: Graph xport modification to...

Fedora 8 : cacti-0.8.7b-1.fc8 (2008-1699)

Fixes: XSS vulnerabilities Path disclosure vulnerabilities SQL injection vulnerabilities HTTP response splitting vulnerabilities bug0000855: Unnecessary and faulty DEF generation for CF:AVERAGE bug0001083: Small visual fix for Cacti in 'View Cacti Log File' bug0001089: Graph xport modification to...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0786: Improper Control of Generation of Code

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

cacti -- Multiple security vulnerabilities have been discovered

Affected packages: cacti 0.8.7b Multiple security vulnerabilities have been discovered in Cacti's web interface: XSS vulnerabilities Path disclosure vulnerabilities SQL injection vulnerabilities HTTP response splitting vulnerabilities References: http://forums.cacti.net/about25749.html -- Mario...