UBB.threads dosearch.php SQL injection

There is a SQL injection issue in the remote version of UBB.threads that may allow an attacker to execute arbitrary SQL statements on the remote host and potentially overwrite arbitrary files there by sending a malformed value to the 'Name' argument of the file 'dosearch.php'. %NASLMINLEVEL 70300...

WowBB <= 1.61 Multiple Vulnerabilities

The remote host is running WowBB, a web-based forum written in PHP. According to its version, the remote installation of WowBB is 1.61 or older. Such versions are vulnerable to cross-site scripting and SQL injection attacks. A malicious user can steal users' cookies, including authentication...

Ipswitch WhatsUp Gold _maincfgret.cgi Remote Overflow

The 'maincfgret' CGI is installed on the remote web server. Some versions are vulnerable to a buffer overflow. Note that Nessus only checked for the presence of this CGI, and did not attempt to determine whether or not it is vulnerable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IdealBB Multiple Vulnerabilities (XSS, SQLi, more)

The remote host is running IdealBB, a web-based bulletin board written in ASP. The remote version of this software has multiple flaws - SQL injection, cross-site scripting and HTTP response splitting vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CoolPHP 1.0 Multiple Vulnerabilities

The remote host is running the CoolPHP Content Management system. There are various flaws in the remote version of this software which may allow an attacker to read arbitrary files on the remote host or to set up a cross-site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FuseTalk Forum img src Tag XSS

The remote host is using FuseTalk, a web-based discussion forum. A vulnerability exists in the script 'tombstone.cfm' that could allow an attacker to execute arbitrary HTML and script code in the context of the user's browser. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

vBulletin memberlist.php what Parameter XSS

The remote version of vBulletin is vulnerable to a cross-site scripting issue due to a failure of the application to properly sanitize user-supplied URI input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be...

vBulletin newreply.php WYSIWYG_HTML Parameter XSS

According to its banner, the remote version of vBulletin is vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing scrip...

CuteNews index.php mod Parameter XSS

The version of CuteNews installed on the remote host is vulnerable to a cross-site scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce a user to browse to a purposefully malicious URI. Upon successful exploitation, the attacker would be able to run code within...

Citrix NFuse Launch Scripts 'NFuse_Application' Parameter XSS

The remote version of Citrix NFuse contains a flaw that allows a remote cross-site scripting attack. An attacker can exploit this issue to execute arbitrary HTML or script code in a user's browser within the security context of the affected site. %NASLMINLEVEL 70300 C Tenable Network Security, In...

CVE-2002-1195

The CVE-2002-1195 entry describes a cross-site scripting (XSS) flaw in the ht://Check 1.1 PHP interface. The vulnerability allows remote web servers to inject arbitrary HTML, including script, through content provided to ht://Check’s PHP interface, via a web page. Public references in the connect...

XOOPS <= 1.0 Dictionary Module Multiple Scripts XSS

The remote version of XOOPS is vulnerable to several cross-site scripting attacks. An attacker can exploit it using the 'terme' and 'letter' parameters of the 'search.php' and 'letter.php' scripts respectively. This can be used to take advantage of the trust between a client and server allowing t...

WebAPP Directory Traversal

There is a flaw in the remote version of WebApp fails to filter directory traversal sequences from the 'viewcat' parameter of the 'index.cgi' script. An unauthenticated attacker can leverage this issue to read arbitrary files on the remote host with the privileges of the web server process...

phpGroupWare index.php Addressbook XSS

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. This version is reportedly prone to multiple HTML injection vulnerabilities. The issues present themselves due to a lack of sufficient input validation performed on form fields used by PHPGroupWare...

Moodle 'post.php' 'reply' Parameter XSS

The version of Moodle on the remote host contains a flaw that allows a remote cross-site scripting attack due to the application not properly validating the 'reply' variable on submission to the 'post.php' script. This allows a user to create a specially crafted URL that would execute arbitrary...

WackoWiki TextSearch phrase Parameter XSS

The remote host seems to be running the WackoWiki CGI suite. Based on the version information gathered by Nessus, this instance of WackoWiki may be vulnerable to a remote authentication attack. Exploitation of this vulnerability may allow for theft of cookie-based authentication credentials and...

BasiliX Message Content XSS

The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions are vulnerable to cross-scripting attacks since they do not filter HTML tags when showing a message. As a result, an attacker can include arbitrary HTML and script code in a message and have that code executed b...

SquirrelMail Detection

The remote host is running SquirrelMail, a PHP-based webmail package that provides access to mail accounts via POP3 or IMAP. This script was written by George A. Theall, . See the Nessus Scripts License for details. Changes by Tenable - Updated to use compat.inc 11/20/2009 include"compat.inc"; if...

Java (.java / .class) Source Code Disclosure

The remote web server is hosting Java .java and/or .class files. These files may contain sensitive or proprietary information. If so, a remote attacker could use this information to mount further attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

ShopCartCGI Multiple Script Traversal Arbitrary File Access

The remote host is running ShopCartCGI - a set of CGIs designed to set up an on-line shopping cart. The version of ShopCartCGI on the remote host fails to sanitize input to several of its CGI scripts before using it to read and display files. An unauthenticated, remote attacker can leverage these...