EUVD-2002-2149

Working Resources Inc. BadBlue Enterprise Edition 1.7 through 1.74 attempts to restrict administrator actions to the IP address of the local host, but does not provide additional authentication, which allows remote attackers to execute arbitrary code via a web page containing an HTTP POST request...

CVE-2002-2170

The CVE affects BadBlue Enterprise Edition versions 1.7–1.74. The root cause is insufficient authentication when attempts to restrict administrator actions to localhost IP, allowing a remote attacker to trigger arbitrary code execution via an HTTP POST to the dir.hts page on localhost, which can ...

Simple PHP Blog: Multiple XSS Vulnerabilities

=========================================================== Simple PHP Blog: Multiple XSS Vulnerabilities =========================================================== Technical University of Vienna Security Advisory TUVSA-0511-001, November 2, 2005...

Xitami Malformed Header DoS Vulnerability

It is possible to freeze the remote web server by sending a malformed POST request. SPDX-FileCopyrightText: 2003 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Xitami malformed header DoS

It is possible to freeze the remote web server by sending a malformed POST request. This is know to affect Xitami 2.5 and earlier versions. OpenVAS Vulnerability Test $Id: xitamiPOSTDoS.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Xitami malformed header DoS Authors: Michel Arboi Copyrigh...

Cherokee POST request DoS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to remote denial of service vulnerability when handling a specially-crafted HTTP 'POST' request. An attacker may exploit this flaw to disable this service remotely. OpenVAS...

Novell NetWare HTTP POST Perl Code Execution Vulnerability

Novell Netware contains multiple default web server installations. SPDX-FileCopyrightText: 2002 visigoth Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cherokee POST request DoS

The remote version of tCherokee is vulnerable to remote denial of service vulnerability when handling a specially-crafted HTTP SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2005-3390

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when registerglobals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field...

CVE-2004-2517

The OpenVAS entries confirm a concrete issue in myServer 0.7.1: a remote denial-of-service caused by sending a specially crafted HTTP POST to index.html with View=Logon, leading to the server crash or stop in responding. Affected component is the HTTP POST handling for the Logon operation; the vu...

phpMyAdmin 2.6.4-pl1 Remote Directory Traversal Exploit

Exploit for unknown platform in category web applications ======================================================= phpMyAdmin 2.6.4-pl1 Remote Directory Traversal Exploit ======================================================= !/usr/bin/perl use IO::Socket; SecurityReason.com TEAM Maksymilian...

CVE-2005-3164

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when...

Hesk 0.920.93 - Session ID Authentication Bypass

Hesk 0.920.93 - Session ID Authentication Bypass source: https://www.securityfocus.com/bid/14879/info Hesk is prone to an authentication bypass vulnerability. Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive...

CVE-2005-2799

Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request...

CVE-2005-2912

Linksys WRT54G router allows remote attackers to cause a denial of service CPU consumption and server hang via an HTTP POST request with a negative Content-Length value...

iDEFENSE Security Advisory 09.13.05: Linksys WRT54G Router Remote Administration apply.cgi Buffer Overflow Vulnerability

Linksys WRT54G Router Remote Administration apply.cgi Buffer Overflow Vulnerability iDEFENSE Security Advisory 09.13.05 www.idefense.com/application/poi/display?id=305&type=vulnerabilities September 13, 2005 I. BACKGROUND The Linksys WRT54G is a combination wireless access point, switch and route...

Class-1 Forum <= 0.24.4 Remote Code Execution Exploit

Exploit for unknown platform in category web applications ===================================================== Class-1 Forum http://rgod.altervista.org make these changes in php.ini if you have troubles with this script: allowcalltimepassreference = on registerglobals = on this is my piece of...

CVE-2005-2845

CVE-2005-2845 affects the Ariba Spend Management System. The issue is that username and password are sent to the server in plaintext via a POST request, enabling remote attackers to obtain sensitive information. The available documents state this plaintext credential exposure but do not provide a...

Flatnuke 2.5.5 - Remote Code Execution

Flatnuke 2.5.5 - Remote Code Execution FlatNuke 2.5.5 remote commands execution FlatNuke 2.5.5 possibly prior versions remote commands execution a script by rgod at http://rgod.altervista.org hostname ex: www...

phpsftpd.txt

Author: Stefan Lochbihler Date: 11. Juli 2005 Affected Software: PHPsFTPd Software Version: 0.2 - 0.4 Software URL: http://phpsftpd.sourceforge.net/ Attack: Admin password leak about PHPsFTPd: PHPsFTPd is a web based administration and configuration interface for the SLimFTPd ftp serverIt can be...