331 matches found
Session ID URL's in logfile
Hi, In the logfiles you can see the session ID's in the URL. Can this be used to hack into a another account?...
Inso DynaWeb httpd 3.1/4.0.2/4.1 Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5384/info Inso DynaWeb webserver, dwhttpd, is used as a subcomponent in products such as Sun's AnswerBook2, which is shipped as part of the Solaris operating environment. The dwhttpd webserver is prone to a remotely...
Junsoft JSparm 4.0 Logging Output File Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2515/info JSparm is the Junsoft Performance Analysis Report Maker package. This software package provides an enhanced perfmon performance monitoring package and interface, as well as a performance report generation...
Jax PHP Scripts 1.0/1.34/2.14/3.31 logfile.csv User IP Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/14482/info Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input. An attacker may leverage any of the...
Snort unified 1 IDS Logging Alert Evasion, Logfile Corruption/Alert Falsify
No description provided by source. Advisory: ========= Snort unified 1 IDS Logging Alert Evasion, Logfile Corruption/Alert Falsify Log: ==== 30/06/2009 Bug detected. 20/07/2009 First mail with snort team. 20/07/2009 Snort team answer they will fix it in the next release 2.8.5. 16/09/2009 Snort...
Positive Software H-Sphere Winbox 2.4 Sensitive Logfile Content Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13559/info It is reported that Positive Software H-Sphere Winbox stores user account information in a plaintext format inside of application log files. As a result, user credentials could be exposed to other local users w...
AWStats 5.x/6.x Logfile Parameter Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12572/info AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data. Specifically, the user-specified 'logfil...
WordPress Backup Plugin 2.0.1 Information Disclosure
No description provided by source. Exploit Title: WordPress Backup plugin exposes site data Google Dork: http://www.google.com/search?q=inurl:wp-content/backup.log Date: 01-jul-2012 Exploit Author: Stephan Knauss Vendor Homepage: http://wordpress.org/extend/plugins/backup/ Software Link:...
AWStats (5.0-6.3) Input Validation Hole in 'logfile'
No description provided by source. Example: http://target/awstats.pl?filterrawlog=&rawlogmaxlines=5000&config=stats.jdims.info&framename=main&pluginmode=rawlog&log file=/etc/passwd...
HFS HTTP File Server 1.5/2.x Multiple Security Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/27423/info HFS HTTP File Server is prone to multiple security vulnerabilities, including cross-site scripting issues, an information-disclosure issue, an arbitrary file-creation issue, a denial-of-service issue, a...
Directory traversal
Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. dot dot in the logfile parameter in a download action...
openSUSE Security Update : thttpd (openSUSE-SU-2013:1862-1)
This update fixes the following security issue with thttpd : - fix CVE-2013-0348 bnc853381 - don't create a world readable logfile %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...
D-Link DSL-320B - Multiple Vulnerabilities
D-Link DSL-320B - Multiple Vulnerabilities Device: DSL-320B Firmware Version: EUDSL-320B v1.23 date: 28.12.2010 Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem ============ Vulnerability Overview: ============ Access to the Config...
WowzaMediaServer SecureToken bypass (and worse)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: By default all installations of WMS use four modules in their application's config file: base, properties, logging, flvplayback. I've found out that the properties...
WordPress Plugin Backup 2.0.1 - Information Disclosure
Exploit Title: WordPress Backup plugin exposes site data Google Dork: http://www.google.com/search?q=inurl:wp-content/backup.log Date: 01-jul-2012 Exploit Author: Stephan Knauss Vendor Homepage: http://wordpress.org/extend/plugins/backup/ Software Link:...
Debian DSA-2401-1 : tomcat6 - several vulnerabilities
Several vulnerabilities have been found in Tomcat, a servlet and JSP engine : - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 The HTTP Digest Access Authentication implementation performed insufficient countermeasures against replay attacks. - CVE-2011-2204 In rare setups passwords were...
DSA-2401-1 tomcat6 - several
Bulletin has no description...
IBM Lotus Domino Server Controller Authentication Bypass Vulnerability
No description provided by source. Exploit Title: IBM Lotus Domino Controller auth. bypass Date:30/11/2011 Author: Alexey Sintsov Software Link: http://www.ibm.com/ Version:8.5.3/8.5.2 FP3 0day Tested on: Windows 7 / Windows 2008 CVE : CVE-2011-1519 Application: IBM Lotus Domino Controller Versio...
SAMHAIN v2.8.5 - intrusion detection system
SAMHAIN v2.8.5 - intrusion detection system The samhain open source host-based intrusion detection system HIDS provides file integrity checking and logfile monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. It has been...
SAMHAIN v2.8.5 - intrusion detection system
SAMHAIN v2.8.5 - intrusion detection system The samhain open source host-based intrusion detection system HIDS provides file integrity checking and logfile monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. It has been...