CVE-2006-4542

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null "%00" character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs...

[SA21690] Webmin / Usermin Cross-Site Scripting and Source Code Disclosure

TITLE: Webmin / Usermin Cross-Site Scripting and Source Code Disclosure SECUNIA ADVISORY ID: SA21690 VERIFY ADVISORY: http://secunia.com/advisories/21690/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: Webmin 1.x...

YaPiG thanks_comment.php Cross-Site Scripting Vulnerability

/ Kuon Armorize Security Team Kuon-at-Armorize.com YaPiG thankscomment.php Cross-Site Scripting Vulnerability Contact : Kuon-at-Armorize.com Link : www.Armorize.com / Armorize Technologies Security Advisory Advisory No: 20061001 Date: 2006/08/25 Affected Software: yapig 0.95b Vulnerability...

Phaos 0.9.2 - 'basename()' Remote Command Execution

DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL TEAM Patriots : - Leito & Leon TomZen, Gelo, Ramzes, DMX,...

[SA21584] Empire CMS "check_path" File Inclusion Vulnerability

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

[SA21594] SportsPHool "mainnav" File Inclusion Vulnerability

TITLE: SportsPHool "mainnav" File Inclusion Vulnerability SECUNIA ADVISORY ID: SA21594 VERIFY ADVISORY: http://secunia.com/advisories/21594/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: SportsPHool 1.x http://secunia.com/product/11629/ DESCRIPTION: Kacper has...

[SA21572] Tutti Nova "TNLIB_DIR" File Inclusion Vulnerabilities

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

CVE-2006-4223

CVE-2006-4223 affects IBM WebSphere Application Server (WAS) before version 6.0.2.13. The issue involves JSP source code exposure via context-dependent paths when ibm-web-ext.xmi sets fileServingEnabled to true or when ExtendedDocumentRoot places a JSP outside a WAR file. This allows an attacker ...

CVE-2006-4223

IBM WebSphere Application Server WAS before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" PK23475, which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place...

CVE-2006-4110

Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase or alternate case characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems...

CVE-2006-4110

Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase or alternate case characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems...

CVE-2006-4110

CVE-2006-4110 affects Apache 2.2.2 running on Windows. An information-disclosure vulnerability arises when the CGI directory is within the document root: requests that alter the case of the directory name bypass the ScriptAlias handler on a case-insensitive filesystem, allowing attackers to read ...

CVE-2006-4110

Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase or alternate case characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems...

Spaminator 1.7 - page Remote File Inclusion

Spaminator 1.7 - page Remote File Inclusion Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...

Thatware 0.4.6 - ROOT_PATH Remote File Inclusion

Thatware 0.4.6 - ROOTPATH Remote File Inclusion Thatware 0.4.6 rootpath Remote File Inclusion CreW: ToXiC Bug Found by Drago84 Source Code: http://ufpr.dl.sourceforge.net/sourceforge/thatware/thatware0.4.6.tar.gz Page Affect config.php ExP:...

Spaminator 1.7 - 'page' Remote File Inclusion

Spaminator 1.7. $page Remote File Include CreW: ToXiC BuG Found By Drago84 SourcE CodE: http://freshmeat.net/redir/spaminator/16281/urltgz/spaminator-1.7.tar.gz Page Affect is: /src/Login.php Problem is include "$page.php"; Path : Declare $page ExpL:...

Apache 2.2.2 - CGI Script Source Code Information Disclosure

Apache 2.2.2 - CGI Script Source Code Information Disclosure source: https://www.securityfocus.com/bid/19447/info Apache is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions. An attacker can exploit this issue to retrieve script source cod...

See-Commerce 1.0.625 - 'owimg.php3' Remote File Inclusion

See-Commerce Remote File Inclusion CreW: ToXiC Bug Found by Drago84 Source Code: http://freshmeat.net/redir/seecommerce/14016/urlzip/sc-1.0.625.zip Problem Is: require$path."/ow.inc"; Page Affect: http://site/see-commerce directory/owimg.php3?path=evil script Greatz : Str0ke milw0rm.com 2006-08-0...

DeluxeBB Multiple Vulnerabilities

DeluxeBB Multiple Vulnerabilities Author: Attila Gerendi Darkz Date: July 30, 2006 Package: DeluxeBB http://www.deluxebb.com/ Versions Affected: 1.08 Other versions may also be affected. Severity: Cross-Site Scripting, Cookie Manipulation, Login Bypass Cross-Site Scripting: When posting a new top...

Hitweb 4.2.1 - REP_INC Remote File Inclusion

Hitweb 4.2.1 - REPINC Remote File Inclusion Hitweb 4.2 Remote Include File CreW: ToxiC Bug Found By Drago84 Sorce Code: http://freshmeat.net/redir/hitweb/15633/urltgz/hitweb-4.2php.tgz Problem is: include "$REPINC/libdatabase.php"; Page: genpage-cgi.php Path: Declare $REPINC Expl:...