34 matches found
Debian Security Advisory DSA 2801-1 (libhttp-body-perl - design error)
Jonathan Dolle reported a design error in HTTP::Body, a Perl module for processing data from HTTP POST requests. The HTTP body multipart parser creates temporary files which preserve the suffix of the uploaded file. An attacker able to upload files to a service that uses HTTP::Body::Multipart cou...
Penetration Testing Browser Bundle: PenQ
PenQ is an open source, Linux-based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. Penetration Testin...
Open Source Web Server Scanner: NIkto
Nikto is an Open Source GPL web server scanner which performs comprehensive tests against web servers for multiple items, including over 6500 potentially dangerous files/CGIs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for...
Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:048)
"A problem exists with PHP3 and PHP4 scripts regarding RFC 1867-based file uploads. PHP saves uploaded files in a temporary directory on the server, using a temporary name that is referenced as the variable $FOO where 'FOO' is the name of the file input tag in the submitted form. Many PHP scripts...
SuSE 11.1 Security Update : Java 1.6.0 (SAT Patch Number 5845)
java-160-openjdk was updated to the IcedTea 1.11.1 b24 release, fixing multiple security issues : - S7082299, CVE-2011-3571: Fix inAtomicReferenceArray - S7088367, CVE-2011-3563: Fix issues in java sound - S7110683, CVE-2012-0502: Issues with some KeyboardFocusManager method - S7110687,...
Nmap NSE net: http-userdir-enum
Attempts to enumerate valid usernames on web servers running with the moduserdir module or similar enabled. The Apache moduserdir module allows user-specific directories to be accessed using the http://example.com/user/ syntax. This script makes http requests in order to discover valid user-...
Fujitsu Systemcast Deployment Server Detection
Binary data 4818.prm...
WebSphere MQ Server Detection
Binary data 4410.prm...
Modicon Quantum HTTP Server Default Credentials
Binary data scadamodicondefaultweb.nbin...
Open Conference System < 1.1.6 Multiple Script fullpath Parameter Remote File Inclusion
The remote host is using Open Conference System, a PHP application for managing scholarly conference websites. The version of Open Conference System installed on the remote host fails to sanitize input to the 'fullpath' parameter before using it to include PHP code in the 'include/theme.inc.php'...
CYBSEC - Multiple Vendor Web Vulnerability Scanner Arbitrary Script Injection Vulnerability
CYBSEC S.A. www.cybsec.com Advisory Name: Multiple Vendor Web Vulnerability Scanner Arbitrary ============= Script Injection Vulnerability Vulnerability Class: Script Injection ==================== Release Date: 09.01.2005 ============= Affected Applications: ====================== N-Stealth...
Icecast Multiple Vulnerabilities
Binary data 2724.prm...