Mambo Site Server 4.0.12 RC2 Cookie Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6926/info Mambo Site Server may grant access without sufficiently validating cookie based authentication credentials. It has been reported that Mambo will accept a user cookie sent by the site as an administrative...

Mambo Site Server 4.0.14 contact.php Unauthorized Mail Relay

No description provided by source. source: http://www.securityfocus.com/bid/8647/info It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database queries and send anonymous...

Microsoft Site Server 3.0 Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3999/info Microsoft Site Server is designed to run on Microsoft Windows NT Server platforms. It provides a means for users on a corporate intranet to share, publish, and find information. Site Server Commerce Edition...

Mambo Site Server 4.0.11 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6387/info A vulnerability has been discovered in Mambo Site Server. Requesting the 'index.php' script with an invalid parameter will cause an error page to be generated containing the path of the Mambo script. Information...

Microsoft Data Access Components (MDAC) <= 2.1,Microsoft IIS 3.0/4.0,Microsoft Index Server 2.0,Microsoft Site Server Commerce Edition 3.0 i386 MDAC RDS Vulnerability (2)

No description provided by source...

Microsoft Site Server 2.0 with IIS 4.0 - File Upload Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1811/info Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through personalized web pages and emails. The...

Mambo Site Server 4.0.10 index.php Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7135/info Mambo Site Server has been reported prone to a cross-site scripting vulnerability. It has been reported that certain user supplied URI parameters are not sufficiently sanitized by the Mambo Site Server. As a...

Microsoft Site Server Commerce Edition 3.0 alpha AdSamples Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/256/info A vulnerability in Microsoft Site Server's Ad Server Sample directory allows the retrieval of a site's configuration file SITE.CSC which contains sensitive information pertaining to an SQL database. The AdSamples...

Microsoft IIS 4.0,Microsoft Site Server 3.0 Showcode ASP Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/167/info A sample Active Server Page ASP script installed by default on Microsoft's Internet Information Server IIS 4.0 gives remote users access to view any file on the same volume as the web server that is readable by t...

MS Site Server < 3.0 formslogin.asp url Parameter XSS

The script 'formslogin.asp' fails to sanitize the 'url' parameter. This allows remote attackers to inject arbitrary web scripts or HTML. %NASLMINLEVEL 70300 Changes by Tenable : - Updated to use compat.inc 11/20/2009 - Updated to use 'a' instead of 'an' 3/2/2018 include'deprecatednasllevel.inc';...

CVE-2002-2288

Mambo Site Server 4.0.11 allows remote attackers to obtain the physical path of the server via an HTTP request to index.php with a parameter that does not exist, which causes the path to be leaked in an error message...

CVE-2002-2290

Mambo Site Server 4.0.11 installs with a default username and password of admin, which allows remote attackers to gain privileges...

CVE-2002-2288

CVE-2002-2288 affects Mambo Site Server 4.0.11. The vulnerability allows a remote attacker to disclose the server’s physical path by issuing an HTTP request to index.php containing a non-existent parameter, which triggers an error message revealing the path. No explicit remediation or patch detai...

CVE-2002-2290

CVE-2002-2290 affects Mambo Site Server 4.0.11, where a default username/password of admin enables remote attackers to gain privileges. The description across sources repeats that a default credential leads to privilege escalation, but no concrete exploit vectors or patched versions are provided ...

CVE-2002-2247

The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive information such as the full web root path via phpinfo.php, which calls the phpinfo function...

CVE-2002-2247

The CVE-2002-2247 entry concerns Mambo Site Server 4.0.11 where the administrator/phpinfo.php script calls phpinfo(), enabling remote attackers to reveal sensitive information such as the full web root path. This is an information-disclosure flaw attributed to phpinfo() usage in that script. The ...

Beoped Portal XSS

Aria-Security.net Advisory Discovered by: O.u.t.l.a.w www.Aria-security.net Gr33t to: A.u.r.a & R@1D3N & Smok3r & DrtRp ----------------------------------------------------------- Software: BeoPed Portal Link And Online Demo : http://www.beoped.com/beoportal/index.php Attack method: Cross Site...

CVE-2005-3738

globals.php in Mambo Site Server 4.0.14 and earlier, when registerglobals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfigabsolutepath parameter to content.html.php for remote PHP file inclusion...

CVE-2005-3738

CVE-2005-3738 affects Mambo Site Server 4.0.14 and earlier. When register_globals is disabled, globals.php can be manipulated to overwrite the GLOBALS array, enabling remote attackers to trigger various attacks, including a remote PHP file inclusion demonstrated via mosConfig_absolute_path in con...

CVE-2005-3738

globals.php in Mambo Site Server 4.0.14 and earlier, when registerglobals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfigabsolutepath parameter to content.html.php for remote PHP file inclusion...