Mambo Site Server itemid Parameter XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid12045; scriptversion"1.20";...

ReviewPost PHP Pro Multiple Script SQL Injections

ReviewPost PHP Pro, a web-based software that manages user's opinions, is installed on the remote web server. The installed version fails to sanitize user input to the 'product' parameter of the 'showproduct.php' script and the 'cat' parameter of the 'showcat.php' script before using it in a...

Aprox PHP Portal index.php Arbitrary File View

The remote host is running Aprox Portal - a PHP-based content management system. There is a bug in this software that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. In addition, this software is reportedly vulnerable to a local file...

mod_python < 2.7.9 / 3.0.4 Malformed Query String DoS

The remote host is using the Apache modpython module older than 2.7.9 or 3.0.4. These versions may be prone to a denial of service attacks when handling malformed queries. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11937; scriptversion"1.24";...

WordPress 'blog.header.php' Multiple Parameter SQL Injection

The version of WordPress running on the remote host is affected by multiple SQL injection vulnerabilities. An attacker can exploit these flaws to execute arbitrary database queries resulting in the disclosure of sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From...

Kukol E.V. HTTP FTP Server Suite 6.2 - File Disclosure

Kukol E.V. HTTP FTP Server Suite 6.2 - File Disclosure source: https://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access ...

Kukol E.V. HTTP & FTP Server Suite 6.2 - File Disclosure

source: https://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access to files outside of the server's web root directory...

CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites...

pod.board 1.1 Multiple Script XSS

The remote host is hosting the Pod.Board CGI suite, a set of PHP scripts designed to manage online forums. There is a cross-site scripting issue in this suite that could allow an attacker to steal the cookies of your legitimate users, by luring them into clicking on a rogue URL. %NASLMINLEVEL 703...

AspUpload Test11.asp Arbitrary File Upload

At least one example script distributed with AspUpload appears to be installed on the remote web server. AspUpload is an ASP script that supports saving and processing files uploading through other web scripts, and the example script likely contains a flaw that allows an attacker to upload...

PostNuke Glossary Module page Parameter SQL Injection

The remote host is running a version of PostNuke which is vulnerable to a SQL injection attack. An attacker may use this flaw to gain the control of the database of this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

mod_gzip Debug Mode mod_gzip_printf Remote Format String

The remote host is running modgzip with debug symbols compiled in. The debug code includes vulnerabilities that can be exploited by an attacker to gain a shell on this host. C Tenable Network Security, Inc. Ref: From: "Matthew Murphy" To: "BugTraq" , Subject: Modgzip Debug Mode Vulnerabilities...

PostNuke Sections Module Information Disclosure

The remote host is running PostNuke. It is possible to use the CMS to determine the full path to its installation on the server or the name of the database used, by doing a request like : /modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid= An attacker may use these flaws to ga...

StockMan Shopping Cart shop.plx Path Disclosure

The remote host is running the StockMan shopping cart. There is a flaw in this version that could allow an attacker to obtain the physical path to the remote web root by requesting a non-exisant page through the 'shop.plx' CGI. An attacker may use this flaw to gain more knowledge about the setup...

Ocean12 Guestbook XSS

The remote server is running Ocean12 GuestBook, a set of scripts to manage an interactive guestbook. An attacker may use this module to inject malicious HTML code in your site, which may be used to steal users' cookies or to simply annoy them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Justice Guestbook 1.3 Multiple Vulnerabilities

The remote host is running Justice Guestbook. This set of CGI has two vulnerabilities : - It is vulnerable to cross-site scripting attacks in jgb.php3. - If the user requests the file cfooter.php3, he will obtain the physical path of the remote CGI. An attacker may use these flaws to steal the...

My Guest Book (myGuestBk) Multiple Vulnerabilities

The remote web server is hosting myGuestBook. This installation comes with an administrative file in 'myguestBk/admin/index.asp' which lets any user delete old entries. In addition to this, this CGI is vulnerable to a cross-site-scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, In...

PostNuke Members_List Module Information Disclosure

The remote host is running PostNuke. It is possible to use the CMS to determine the full path to its installation on the server or the name of the database used, by doing a request like : /modules.php?op=modload&name=MembersList&file=index&letter=All&sortby=foobar An attacker may use these flaws ...

Basit CMS Multiple Script XSS

Basit cms 1.0 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host. In addition to this, it is vulnerable to a SQL insertion attack that could allow an attacker to get the control of your database. %NASLMINLEVEL 70300 written by K-Otik.com...

Mambo Site Server 4.0.10 XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host. %NASLMINLEVEL 70300 This script was completely rewritten by Tenable Network Security, using a new API Message-ID: From: Ertan Kurt To: Subject: Some XSS vulns...