CVE-2004-0763: Undefined Security Weakness

Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method...

SquirrelMail Detection

The remote host is running SquirrelMail, a PHP-based webmail package that provides access to mail accounts via POP3 or IMAP. This script was written by George A. Theall, . See the Nessus Scripts License for details. Changes by Tenable - Updated to use compat.inc 11/20/2009 include"compat.inc"; if...

Java (.java / .class) Source Code Disclosure

The remote web server is hosting Java .java and/or .class files. These files may contain sensitive or proprietary information. If so, a remote attacker could use this information to mount further attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

ShopCartCGI Multiple Script Traversal Arbitrary File Access

The remote host is running ShopCartCGI - a set of CGIs designed to set up an on-line shopping cart. The version of ShopCartCGI on the remote host fails to sanitize input to several of its CGI scripts before using it to read and display files. An unauthenticated, remote attacker can leverage these...

Mambo Site Server itemid Parameter XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid12045; scriptversion"1.20";...

ReviewPost PHP Pro Multiple Script SQL Injections

ReviewPost PHP Pro, a web-based software that manages user's opinions, is installed on the remote web server. The installed version fails to sanitize user input to the 'product' parameter of the 'showproduct.php' script and the 'cat' parameter of the 'showcat.php' script before using it in a...

Aprox PHP Portal index.php Arbitrary File View

The remote host is running Aprox Portal - a PHP-based content management system. There is a bug in this software that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. In addition, this software is reportedly vulnerable to a local file...

mod_python < 2.7.9 / 3.0.4 Malformed Query String DoS

The remote host is using the Apache modpython module older than 2.7.9 or 3.0.4. These versions may be prone to a denial of service attacks when handling malformed queries. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11937; scriptversion"1.24";...

WordPress 'blog.header.php' Multiple Parameter SQL Injection

The version of WordPress running on the remote host is affected by multiple SQL injection vulnerabilities. An attacker can exploit these flaws to execute arbitrary database queries resulting in the disclosure of sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From...

Kukol E.V. HTTP FTP Server Suite 6.2 - File Disclosure

Kukol E.V. HTTP FTP Server Suite 6.2 - File Disclosure source: https://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access ...

Kukol E.V. HTTP & FTP Server Suite 6.2 - File Disclosure

source: https://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access to files outside of the server's web root directory...

CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites...

pod.board 1.1 Multiple Script XSS

The remote host is hosting the Pod.Board CGI suite, a set of PHP scripts designed to manage online forums. There is a cross-site scripting issue in this suite that could allow an attacker to steal the cookies of your legitimate users, by luring them into clicking on a rogue URL. %NASLMINLEVEL 703...

AspUpload Test11.asp Arbitrary File Upload

At least one example script distributed with AspUpload appears to be installed on the remote web server. AspUpload is an ASP script that supports saving and processing files uploading through other web scripts, and the example script likely contains a flaw that allows an attacker to upload...

PostNuke Glossary Module page Parameter SQL Injection

The remote host is running a version of PostNuke which is vulnerable to a SQL injection attack. An attacker may use this flaw to gain the control of the database of this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

mod_gzip Debug Mode mod_gzip_printf Remote Format String

The remote host is running modgzip with debug symbols compiled in. The debug code includes vulnerabilities that can be exploited by an attacker to gain a shell on this host. C Tenable Network Security, Inc. Ref: From: "Matthew Murphy" To: "BugTraq" , Subject: Modgzip Debug Mode Vulnerabilities...

PostNuke Sections Module Information Disclosure

The remote host is running PostNuke. It is possible to use the CMS to determine the full path to its installation on the server or the name of the database used, by doing a request like : /modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid= An attacker may use these flaws to ga...

StockMan Shopping Cart shop.plx Path Disclosure

The remote host is running the StockMan shopping cart. There is a flaw in this version that could allow an attacker to obtain the physical path to the remote web root by requesting a non-exisant page through the 'shop.plx' CGI. An attacker may use this flaw to gain more knowledge about the setup...

Ocean12 Guestbook XSS

The remote server is running Ocean12 GuestBook, a set of scripts to manage an interactive guestbook. An attacker may use this module to inject malicious HTML code in your site, which may be used to steal users' cookies or to simply annoy them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Justice Guestbook 1.3 Multiple Vulnerabilities

The remote host is running Justice Guestbook. This set of CGI has two vulnerabilities : - It is vulnerable to cross-site scripting attacks in jgb.php3. - If the user requests the file cfooter.php3, he will obtain the physical path of the remote CGI. An attacker may use these flaws to steal the...