WowWee Rovio - Insufficient Access Controls - Covert Audio/Video Snooping Possible

SUMMARY WowWee Rovio - Insufficient Access Controls - Covert Audio/Video Snooping Possible OVERVIEW Rovio from WowWee does not adequately secure all accessible URLs or media streams, enabling an unauthorized user with network access to the robotic webcam platform the ability to listen to and view...

Microsoft Internet Explorer Argument Injection Vulnerability

This host has installed Internet Explorer and is prone to Argument Injection vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

RHEL 5 : vim (RHSA-2008:0580)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0580 advisory. - vim format string flaw CVE-2007-2953 - vim: command execution via scripts not sanitizing inputs to execute and system CVE-2008-2712 - Vim...

iamma-upload.txt

Found by: X0r Iamma Simple Gallery Arbitrary File Upload Version: 1,2 ? Email: evolutionteam.x0atgmaildotcom Script Download:http://www.matteoiammarrone.com/public/modules.php?name=Downloads&dop=getit&lid=4 Script Download...

CVE-2008-2940

The alert-mailing implementation in HP Linux Imaging and Printing HPLIP 1.6.7 allows local users to gain privileges and send e-mail messages from the root account via vectors related to the setalerts message, and lack of validation of the device URI associated with an event message...

ZDI-08-027: CA BrightStor ARCserve Backup Arbitrary File Writing Vulnerability

ZDI-08-027: CA BrightStor ARCserve Backup Arbitrary File Writing Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-027 -- CVE ID: CVE-2008-2241 -- Affected Vendors: Computer Associates -- Affected Products: Computer Associates BrightStor ARCserve Server -- TippingPointTM IPS Custom...

FreeBSD : xfs -- multiple vulnerabilities (a5f667db-7596-11dc-8b7a-0019b944b34e)

Matthieu Herrb reports : Problem Description : Several vulnerabilities have been identified in xfs, the X font server. The QueryXBitmaps and QueryXExtents protocol requests suffer from lack of validation of their 'length' parameters. Impact : On most modern systems, the font server is accessible...

CVE-2007-3806

The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initializati...

CVE-2007-3806

The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initializati...

ifdate-bypass.txt

vendor : Liz0zim web: www.biyosecurity.net www.expw0rm.com Script Home Page : http://www.ifusionservices.co.uk/ vul. version : iFdate 2. vul code : all admin folder files /////////////////////////////////////// // Checks user is logged in // /////////////////////////////////////// if...

EUVD-2007-0526

The admin web console implemented by the Centrality Communications aka Aredfox PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser session...

CVE-2006-4949

Cross-site scripting XSS vulnerability in the Drupal 4.6 Site Profile Directory profilepages.module before 1.1.2.1 and the Drupal 4.7 Site Profile Directory profilepages.module before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack o...

Russcom PHPImages lack of validation

Russcom PHPImages lack of validation Discovered by: Nomenumbra Date: 21/5/2006 impact:moderate Russcom's PHPImages doesn't validate if the uploaded file is an image, it just checks for the extension, thus allowing an attacker to upload php scripts with a .gif extension for example, potentially...

Web4Future Portal Solutions - 'Arhiva.php' Directory Traversal

source: https://www.securityfocus.com/bid/15718/info Portal Solutions is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input. This issue may be leveraged to read arbitrary files on an affected computer with the privileges of the Web...

Torrential 1.2 - 'Getdox.php' Directory Traversal

source: https://www.securityfocus.com/bid/15530/info Torrential is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input. An attacker can exploit this issue to retrieve arbitrary remote PHP code on an affected computer with the privilege...

EUVD-2002-2149

Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request...

Bugzilla remote arbitrary command execution

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to arbitrary commands execution flaws due to a lack of sanitization of user-supplied data in processbug.cgi OpenVAS Vulnerability Test $Id: bugzillaremoteexec.nasl 8023 2017-12-07 08:36:26Z teissa $ Descriptio...

Tiki Wiki CMS Groupware < 1.7.8 'tiki-error.php' XSS Vulnerabilities

Tiki Wiki CMS Groupware is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft DirectPlay DoS Vulnerability (839643)

A denial of service DoS vulnerability exists in the implementation of the IDirectPlay4 application programming interface API of Microsoft DirectPlay because of a lack of robust packet validation. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced...

EPay Pro 2.0 - 'index.php' Directory Traversal

source: https://www.securityfocus.com/bid/14871/info EPay Pro is prone to a directory traversal vulnerability. This is due to a lack of proper validation of user-supplied input. An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable...