[SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-0580: Tomcat information disclosure vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.27 Tomcat 6.0.0 to 6.0.18 The unsupported Tomcat 3.x, 4.0.x and 5.0.x version...

SQL Injection vulnerability in myPHPNuke

Здравствуйте 3APA3A! Сообщаю вам о найденной мною SQL Injection уязвимости в системе myPHPNuke. SQL Injection: POST запрос на странице http://site/admin.php " from mpnauthors where benchmark10000,md5now!=1/ В поле Nickname. Auth Bypass атака в данном случае невозможна, только Blind SQL Injection...

PJBlog博客系统后台Action.aspSQL注入缺陷

PJBlog一套开源免费的中文个人博客系统程序，采用asp+Access的技术，PJBlog同时支持简繁中文，UTF-8编码，相对于其他系统，PJBlog具有相当高的运作效能以及更新率，也支持目前Blog所使用的新技术。 在文件control/ Action.aspp中。 变量moduleID，GetPlugName，KeyWordID，smilesID，LinkID，memID，doCommID，selCommID，TagsID，DelCate没有过滤放入sql语句导致注入漏洞的产生。 3.0 Beta PJblog -------...

IceWarp WebMail口令取回功能输入验证漏洞

BUGTRAQ ID: 34827 CVECAN ID: CVE-2009-1469 Merak Email Server是一个全面的办公室局域网或Internet通讯邮件解决方案。 Merak邮件服务器的WebMail模块在登陆页面提供了“忘记口令”取回功能，忘记了登录口令的用户可以在这里向邮件服务器提供他们的邮件地址，之后服务器检查系统中是否存在这个地址并将相关的用户口令发回到这个地址。 在点击Forgot Password页面的提交按键时，所发送的HTTP POST请求包含有类似于以下的负载：...

CVE-2009-1191

modproxyajp.c in the modproxyajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request...

CVE-2009-1191

modproxyajp.c in the modproxyajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request...

Cross site request forgery (csrf)

modproxyajp.c in the modproxyajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request...

CVE-2009-1191

modproxyajp.c in the modproxyajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request...

CVE-2009-1191

modproxyajp.c in the modproxyajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request...

Cross site scripting

Cross-site scripting XSS vulnerability in refreshrate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body...

CVE-2009-1333

Cross-site scripting XSS vulnerability in refreshrate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body...

CVE-2009-1333

CVE-2009-1333 affects the HP Deskjet 6840 printer web interface, specifically the refresh_rate.htm page. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the POST request body. The implicated firmware is XF1M131A. The a...

CVE-2009-1333

Cross-site scripting XSS vulnerability in refreshrate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body...

phpMyAdmin配置文件PHP代码注入漏洞

BUGTRAQ ID: 34526 CVECAN ID: CVE-2009-1285 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin所使用的setup脚本没有正确地过滤配置参数，如果远程攻击者向服务器提交了恶意的POST请求，就可以在所生成的配置文件中注入任意PHP代码。 phpMyAdmin phpMyAdmin 3.x phpMyAdmin phpMyAdmin 2.11.x phpMyAdmin ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

phpMyAdmin Setup Script Configuration Parameters Arbitrary PHP Code Injection (PMASA-2009-4)

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input before using it to generate a config file for the application. This version is affected by the following vulnerabilities : - The setup script inserts the unsanitize...

phpmyadmin -- insufficient output sanitizing when generating configuration file

phpMyAdmin Team reports: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. This...

HP Deskjet 6840打印机refresh_rate.htm跨站脚本漏洞

BUGTRAQ ID: 34480 HP Deskjet 6840是一款彩色喷墨打印机。 HP Deskjet 6840打印机的WEB接口存在跨站脚本漏洞。如果远程攻击者通过POST请求向/refreshrate.htm页面提交了类似于scriptalert"found XSS on this page"/script的字符串的话，所生成的出错页面就会执行请求中嵌入的脚本。 HP Deskjet 6840 XF1M13 HP -- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://itrc.hp.com...

Family Connections 1.8.2 - Arbitrary File Upload

/ Family Connections include include include include include include include int socketconnectchar server, int port int fd; struct sockaddrin sock; struct hostent host; memset&sock, 0, sizeofsock; iffd = socketAFINET, SOCKSTREAM, 0 haddr; ifconnectfd, struct sockaddr &sock, sizeofsock 0 return -1...

phpmyadmin -- insufficient output sanitizing when generating configuration file

phpMyAdmin reports: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file...

Ubuntu Update for elinks vulnerability USN-519-1

Ubuntu Update for Linux kernel vulnerabilities USN-519-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5191.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for elinks vulnerability USN-519-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...