JVN#89292430 Cross-site scripting in Sun Java System Web Server and Sun Java System Web Proxy Server

Sun Java System Web Server and Sun Java System Web Proxy Server, which are both web servers, provide a function for a user to view access logs and other records in a web browser. This function is vulnerable to cross-site scripting. Impact An arbitrary script can be executed on the user's web...

trivantis-sql.txt

+==================================================================================================+ + Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338 + +==================================================================================================+...

CVE-2007-6081

AdventNet EventLog Analyzer (Windows, build 4030, and possibly other versions) ships a MySQL instance with a default root/passwordless account, enabling remote attackers to gain privileges and modify logs. The vulnerability is fixed in EventLog Analyzer Build 6000. Affected component: bundled MyS...

mailman logfile CRLF injection

CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI...

BT Home Hub 6.2.2.6 - Login procedure Authentication Bypass

source: https://www.securityfocus.com/bid/26333/info BT Home Hub is prone to an authentication-bypass vulnerability. An attacker could exploit this issue to gain unauthorized access to the affected device. BT Home Hub firmware 6.2.2.6 is vulnerable; other versions may also be affected. This explo...

CVE-2007-5619

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

Design/Logic Flaw

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

CVE-2007-5619

Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges...

CVE-2004-2713

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2007-5113

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...

Authentication flaw

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...

CVE-2007-5113

CVE-2007-5113 affects Google Urchin 5 (<= 5.7.03) where report.cgi allows remote attackers to bypass authentication and access sensitive information (web server logs) by modifying query parameters such as profile, rid, prefs, n, vid, bd, ed, dt, and gtype. The vulnerability is related to an au...

DEBIAN-CVE-2007-4321

fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol versi...

Cross site scripting

Cross-site scripting XSS vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs...

CVE-2007-3910

Cross-site scripting XSS vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs...

CVE-2007-3910

Cross-site scripting XSS vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs...

CVE-2007-3910

Bandersnatch 0.4 is affected by an XSS vulnerability (CVE-2007-3910) where remote attackers can inject arbitrary JavaScript via a Jabber resource name (and possibly other data items) that are stored in conversation logs. Multiple sources in the connected set corroborate the issue and describe the...

Design/Logic Flaw

The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to read a list of missed calls, received calls, and dialed numbers via a direct request to the web server on port 1800...

CVE-2007-3439

The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to read a list of missed calls, received calls, and dialed numbers via a direct request to the web server on port 1800...

CVE-2007-3200

NMASINST in Novell Modular Authentication Service NMAS 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file...