4763 matches found
PHPPass 2 - 'AccessControl.php' SQL Injection
source: https://www.securityfocus.com/bid/6594/info A problem with phpPass may allow an attacker to launch a SQL injection attack. The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote...
a.shopKart Shopping Cart remote vulnerabilities
Centaura Technologies Security Research Lab Advisory Product Name: a.shopKart Web Shopping Cart Systems: Windows NT/2000/.NET Server Severity: High Risk Remote: Yes Category: Insuficient input checking Vendor URL: http://www.urlogy.com Advisory Author: Ignacio Vazquez Advisory URL:...
Emacs 2.1 - Local Variable Arbitrary Command Execution
Emacs 2.1 - Local Variable Arbitrary Command Execution source: https://www.securityfocus.com/bid/15375/info Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input. By modifying a text file to...
BizDesign ImageFolio 2.x3.0.1 - nph-build.cgi Cross-Site Scripting
BizDesign ImageFolio 2.x3.0.1 - nph-build.cgi Cross-Site Scripting source: https://www.securityfocus.com/bid/6265/info Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included...
Working Resources BadBlue 1.7.1 - Search Page Cross-Site Scripting
source: https://www.securityfocus.com/bid/6253/info The ext.dll ISAPI does not sufficiently sanitize user-supplied input when processing search queries. This may allow an attacker to create a custom URL containing script code that, when viewed in a browser by a legitimate user, will result in the...
vpopmail CGIapps vpasswd vulnerabilities
Centaura Technologies Security Research Lab Advisory Product Name: vpopmail-CGIApps Systems: Linux/OpenBSD/FreeBSD/NetBSD Severity: High Risk Remote: Yes Category: Insuficient input checking Vendor URL: http://diario.buscadoc.org/index.php?topic=Programas Advisory Author: Ignacio Vazquez Advisory...
vpopmail CGIapps vadddomain multiple vulnerabilities
Centaura Technologies Security Research Lab Advisory Product Name: vpopmail-CGIApps Systems: Linux/OpenBSD/FreeBSD/NetBSD Severity: High Risk Remote: Yes Category: Insuficient input checking Vendor URL: http://diario.buscadoc.org/index.php?topic=Programas Advisory Author: Ignacio Vazquez Advisory...
SurfControl SuperScout WebFilter for Windows 2000 - SQL Injection
SurfControl SuperScout WebFilter for Windows 2000 - SQL Injection source: https://www.securityfocus.com/bid/5859/info SurfControl SuperScout WebFilter Reports Server is prone to SQL injection attacks. This issue is due to insufficient input validation on the part of some of the reports files, whi...
DB4Web 3.43.6 - File Disclosure
DB4Web 3.43.6 - File Disclosure source: https://www.securityfocus.com/bid/5723/info DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms. A...
PHPReactor 1.2.7 - Style Attribute HTML Injection
PHPReactor 1.2.7 - Style Attribute HTML Injection source: https://www.securityfocus.com/bid/5569/info phpReactor does not sufficiently sanitize HTML from various fields such as in the body of a message or in profile fields. It is possible to inject arbitrary HTML and script code into these fields...
ShoutBox 1.2 - Form HTML Injection
ShoutBox 1.2 - Form HTML Injection source: https://www.securityfocus.com/bid/5354/info shoutBOX does not sufficiently sanitize HTML tags from input supplied via form fields. Attackers may exploit this lack of input validation to inject arbitrary HTML and script code into pages that are generated ...
WorldClient 5.0.x - Arbitrary File Deletion
WorldClient 5.0.x - Arbitrary File Deletion source: https://www.securityfocus.com/bid/4687/info WorldClient is a web interface packaged with MDaemon, an email server for Microsoft Windows. An input validation vulnerability exists in WorldClient that allows for an attacker to delete an arbitrary...
Solaris 7.08 Sunsolve CD - SSCD_SunCourier.pl CGI Script Arbitrary Command Execution
Solaris 7.08 Sunsolve CD - SSCDSunCourier.pl CGI Script Arbitrary Command Execution source: https://www.securityfocus.com/bid/4269/info The Sunsolve CD is part of the Solaris Media pack. It is included as a documentation resource, and is available for the Solaris Operating Environment. A CGI scri...
PHP-Nuke 4.x/5.x - Arbitrary File Inclusion
source: https://www.securityfocus.com/bid/3889/info PHPNuke is a website creation/maintenance tool. The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the...
PHP-Nuke 4.x5.x - Arbitrary File Inclusion
PHP-Nuke 4.x5.x - Arbitrary File Inclusion source: https://www.securityfocus.com/bid/3889/info PHPNuke is a website creation/maintenance tool. The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on ...
YaBB 9.1.2000 - Cross-Agent Scripting
YaBB 9.1.2000 - Cross-Agent Scripting source: https://www.securityfocus.com/bid/3828/info YaBB Yet Another Bulletin Board is freely available web forums/community software that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS, and Microsoft Windows 9x/ME/NT/2000/XP platforms...
Дырка в NetBSD на процессорах Hitachi (privelege escalation)
Недостаточная проверка ввода пользователя в нескольких системных вазовах...
Solaris 2.52.67.08 - mailx -F Local Buffer Overflow (1)
Solaris 2.52.67.08 - mailx -F Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/2610/info Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and...
datawizards ftpxq 2.0.93 - Directory Traversal
datawizards ftpxq 2.0.93 - Directory Traversal source: https://www.securityfocus.com/bid/2426/info FtpQX is a ftp daemon designed to provide ftp services for Microsoft Operating Systems. It is maintained and distributed by Datawizard Technologies. A problem in the software could allow access to...