IlohaMail Insecure Configuration Files

------------------------------------------------ Advisory Name : IlohaMail Insecure Configuration Files Release Date : 10 January, 2004 Application : IlohaMail http://ilohamail.org/ Vulnerable: IlohaMail-0.8.14-rc1 and lower Not Vulnerable: IlohaMail-0.8.14-rc2 Author : SRR Project Group of Ready...

IPBProArcade 2.5 - SQL Injection

IPBProArcade 2.5 - SQL Injection source: https://www.securityfocus.com/bid/11719/info A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query. An attacker...

Trend Micro ScanMail for Domino 2.512.6 - Remote File Disclosure

Trend Micro ScanMail for Domino 2.512.6 - Remote File Disclosure source: https://www.securityfocus.com/bid/11612/info ScanMail for Domino is reported prone to a vulnerability that may allow sensitive configuration files to be disclosed to remote attackers. A successful attack may allow an attacke...

MailPost vulnerable to cross-site scripting in the 'append' variable passed to the file as part of an HTTP GET request

Overview A cross-site scripting vulnerability is reported to exist in MailPost version 5.1.1sv and possibly earlier versions. Description According to a report by ProCheckUp, MailPost is vulnerable to a Cross-Site Scripting attack via the 'append' variable. The 'append variable is passed as part ...

Netbilling nbmember.cgi cmd Parameter Information Disclosure

nbmember.cgi is installed on the remote host. The remote version of this software is vulnerable to an information disclosure flaw which may allow an attacker to access sensitive system information resulting in a loss of confidentiality. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 566-1] New CUPS packages fix information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 566-1 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...

FreezingCold Broadboard - profile.asp SQL Injection

FreezingCold Broadboard - profile.asp SQL Injection source: https://www.securityfocus.com/bid/11250/info Reportedly BroadBoard Message Board is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI input pri...

FreezingCold Broadboard - 'profile.asp' SQL Injection

source: https://www.securityfocus.com/bid/11250/info Reportedly BroadBoard Message Board is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI input prior to using it in an SQL query. An attacker may...

FreezingCold Broadboard - search.asp SQL Injection

FreezingCold Broadboard - search.asp SQL Injection source: https://www.securityfocus.com/bid/11250/info Reportedly BroadBoard Message Board is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI input prio...

FreezingCold Broadboard - 'search.asp' SQL Injection

source: https://www.securityfocus.com/bid/11250/info Reportedly BroadBoard Message Board is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI input prior to using it in an SQL query. An attacker may...

Mandrake Linux Security Advisory : openssh (MDKSA-2001:033-2)

There are several weaknesses in various implementations of the SSH Secure Shell protocols. When exploited, they let the attacker obtain sensitive information by passively monitoring encrypted SSH sessions. The information can later be used to speed up brute-force attacks on passwords, including t...

NetBIOS Name Service Reply Information Disclosure

Binary data 1922.prm...

[NT] FTP Glide Stores Login Information in Cleartext

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

tn-linksys.txt

---------------------------------- Telconinjas Computer Security Lab Contact: [email protected] Severity: Low Vendor: Linksys ---------------------------------- Affected Products: Linksys Wireless Internet Camera Version 2.12 was the only testbed available, though I am sure other versions near this...

Invision Power Board 1.3 - 'SSI.php' SQL Injection

source: https://www.securityfocus.com/bid/10511/info Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script. Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQL statements to the underlying database. The impa...

Invision Power Board 1.3 - SSI.php SQL Injection

Invision Power Board 1.3 - SSI.php SQL Injection source: https://www.securityfocus.com/bid/10511/info Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script. Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQ...

CVE-2004-0133

The XFS file system code in Linux 2.4.x has an information leak in which in-memory data is written to the device for the XFS file system, which allows local users to obtain sensitive information by reading the raw device...

DSA-471 interchange - missing input sanitising

Bulletin has no description...

Cactusoft CactuShop 5.05.1 - SQL Injection

Cactusoft CactuShop 5.05.1 - SQL Injection source: https://www.securityfocus.com/bid/10019/info Reportedly CactuShop is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user-supplied URI input before using it to craft an SQL query. As a result of...

CVE-2002-1578

The default installation of SAP R/3, when using Oracle and SQLnet V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected...