MyServer HTTP server multiple security vulnerabilities

Crossite scripting with demo pages, script source code access with capital character in path...

MyServer-0.8.9 - source code disclosure

The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. Found By:Shay Priel aka Prili site: http://www.myserverproject.net/ poc: ---- http://localhost/cgi-bin/post.mscgI I -...

netjukebox vuln.

netjukebox vuln. Vuln. discovered by : r0t Date: 21 June 2007 vendor:http://www.netjukebox.nl/ orginal advisory: http://pridels-team.blogspot.com/2007/06/netjukebox-vuln.html affected versions: tested on "netjukebox 4.01b" other versions also can be affected. netjukebox contains a flaws that allo...

HTTP SERVER (httpsv1.6.2) source code disclosure

HTTP SERVER httpsv1.6.2 source code disclosure http://httpsv.sourceforge.net/ The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. POC: http://127.0.0.1/test.htm20 Bug Found...

Interact multiple XSS vuln.

Interact multiple XSS vuln. Vuln. discovered by : r0t Date: 21 June 2007 vendor:www.interactole.org orginal advisory: http://pridels-team.blogspot.com/2007/06/interact-multiple-xss-vuln.html affected versions: tested on "Interact 2.4 beta 1" other versions also can be affected. Interact contains ...

Apache Prefork MPM vulnerabilities - Report

----- Apache Prefork MPM vulnerabilities ---------------------------------- PSNC Security Team http://security.psnc.pl/files/apachereport.pdf 1. Introduction This small case study is a result of source code analysis of Apache httpd server MPM modules. The main goal of this document is to show, wh...

PHP Live! Support XSS vuln.

PHP Live! Support XSS vuln. Vuln. discovered by : r0t Date: 12 June 2007 vendor:http://www.phplivesupport.com/ affected versions: 3.2.2 and prior orginal advisory: http://pridels-team.blogspot.com/2007/06/php-live-support-xss-vuln.html PHP Live! contains a flaw that allows a remote Cross-Site...

PHP parse_str() arbitrary variable overwrite

Title: PHP parsestr arbitrary variable overwrite Vendor: http://www.php.net/ Advisory: http://www.acid-root.new.fr/advisories/14070612.txt Author: DarkFig gmdarkfig at gmail dot com Written on: 2007/06/12 Released on: 2007/06/12 Risk level: Medium / High I.BACKGROUND Quote from php.net PHP is a...

Track+ XSS vuln.

Vuln. discovered by : r0t Date: 19 May 2007 vendor:http://www.trackplus.com/ affected versions: 3.3.2 and prior Track+ contains a flaw that allows a remote Cross-Site Scripting attacks.Input passed to the "projId" parameter in "reportItem.do" isn't properly sanitised before being returned to the...

Analysis upload vulnerability-vulnerability warning-the black bar safety net

This article sent to the hacker line of Defense of 2006.4 period, reproduced please indicate the Analysis upload vulnerability in the form English / the loneliness of the hedgehog In a brief introduction through the injection vulnerability check and fill, following the coupling re-introduce a...

Directory traversal

Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager phpATM 1.30 allows remote attackers to read arbitrary files and obtain script source code via a .. dot dot in the directory parameter in a downloadfile action...

WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV82$2007 ----------------------------------------------------------------------------------------- ECHOADV82$2007 wordpress plugins wp-Table = 1.43 incdir Remote File Inclusion Vulnerability...

WordPress Plugin wp-Table 1.43 - inc_dir Remote File Inclusion

WordPress Plugin wp-Table 1.43 - incdir Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV82$2007 ----------------------------------------------------------------------------------------- ECHOADV82$2007 wordpress plugins wp-Table = 1.43...

Phorum 5.1.20 - includecontrolcenterusers.php Multiple Method Privilege Escalations

Phorum 5.1.20 - includecontrolcenterusers.php Multiple Method Privilege Escalations source: https://www.securityfocus.com/bid/23616/info Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues,...

qdblog-lfisql.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-12 Product : QDBlog Version : v0.4 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/qdblog/ Vendor Status : 2007-04-12 - Not Informed! Description : QDBlog is an open-source, simple, minimalistic blogging...

Jikto download-vulnerability warning-the black bar safety net

Sources of information: B. S. T What is the Jikto it? CNET network 4 on 4, International reports Web Security vendor SPI Dynamics originally don't want to make a network on the PC into hack helper tool for the outflow, but now the tools of the source code or the outflow went. "Jikto source code h...

Kerberos 1.5.1 Kadmind Remote Root Buffer Overflow Vulnerability

No description provided by source. Kerberos Version 1.5.1 Kadmind Remote Root Buffer Overflow Vulnerability The Issue: Remotely exploitable buffer overflow vulnerability in Kerberos kadmind service The Versions: krb5-1.5.1 Latest version from http://eb.mit.edu/Kerberos/ krb5-server-1.4.3-5.1 Late...

pL-PHP beta 0.9 - Multiple Vulnerabilities

. . . . | . .| . .;/ || .| .net | .| "pL-PHP beta 0.9 - MULTIPLE VULNERABILITIES" by Omni 1 Infos --------- Date : 2007-04-10 Product : pL-PHP Version : beta 0.9 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/pl-php/ - http://www.karlcore.com/programming/blog/...

plphp-multi.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-10 Product : pL-PHP Version : beta 0.9 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/pl-php/ - http://www.karlcore.com/programming/blog/ Vendor Status : 2007-04-10 - Not Informed! Description : pL-PHP is a ne...

pL-PHP beta 0.9 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications =============================================== pL-PHP beta 0.9 Multiple Remote Vulnerabilities =============================================== . . . . | . .| . .;/ || Infos --------- Date : 2007-04-10 Product : pL-PHP Version : beta 0.9 -...