CVE-2010-3692

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU PGTiou parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

Design/Logic Flaw

PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file...

CVE-2010-3690

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

CVE-2010-3692

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU PGTiou parameter...

CVE-2010-3690

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

CVE-2010-3691

PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file...

CVE-2010-3692

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU PGTiou parameter...

CVE-2010-3690

CVE-2010-3690 refers to multiple cross-site scripting (XSS) flaws in the phpCAS library used by Moodle, exploitable when proxy mode is enabled. The vulnerabilities allow remote attackers to inject arbitrary script/HTML via the Proxy Granting Ticket IOU parameter to the callback (client.php) or th...

CVE-2010-3690

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

PT-2010-5004

Name of the Vulnerable Software and Affected Versions phpCAS versions prior to 1.1.3 Description The issue allows local users to overwrite arbitrary files via a symlink attack when proxy mode is enabled. This is due to a vulnerability in the PGTStorage/pgt-file.php file. Recommendations For...

CVE-2010-3690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

CVE-2010-2796

CVE-2010-2796 is an XSS vulnerability in phpCAS prior to 1.1.2 when proxy mode is enabled, allowing an attacker to inject script via a callback URL. The flaw affects phpCAS usage embedded in applications such as Moodle that include phpCAS. Remediation references imply upgrading to phpCAS 1.1.2 or...

CVE-2010-2796

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...

CVE-2010-2796: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...

CVE-2004-2107

Finjan SurfinGate 6.0/7.0, when in proxy mode, permits unauthenticated FHTTP commands on TCP port 3141. An attacker can use the finjan-parameter-type header to (1) restart the service, (2) view log information via getlastmsg, or (3) force a policy update from the database server via an online com...

CVE-2004-2107

Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to 1 restart the service, 2 use the getlastmsg command to view log information, or 3 use the online command to...

Finjan SurfinGate Vulnerability

VENDOR: Finjan www.finjan.com PRODUCT: SurfinGate recently renamed “Vital Security” VERSIONS: All releases of versions 6 & 7 as of 1/22/2004. Older versions have not been tested. NOTIFICATION: The vendor has known of the problem over a year DESCRIPTION...