e107 ePing Plugin doping.php Arbitrary Code Execution

The installation of e107 on the remote host includes a version of the ePing plugin that is affected by a command execution vulnerability. This plugin fails to sanitize the 'epingcmd', 'epingcount' and/or 'epinghost' parameters of the 'doping.php' script before using them in a system call. An...

Horde Nag common-footer.inc Parent Frame Page Title XSS

According to its version, the remote installation of Nag fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...

Mac OS X 10.3.x < 10.3.9 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.3.x that is prior to 10.3.9. Mac OS X 10.3.9 contains several security fixes for : - Safari : a remote local zone script execution vulnerability has been fixed - kernel : multiple local privilege escalation vulnerabilities have been fixed C...

NetWin SurgeMail Multiple Remote Unspecified Vulnerabilities

The remote host is running NetWin SurgeMail, a mail server application. The remote version of this software is affected by multiple unspecified vulnerabilities that have been disclosed by the vendor. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid17594; scriptversio...

PunBB profile.php Multiple Parameter XSS

According to its banner, the version of PunBB installed on the remote host fails to properly sanitize user input to the script 'profile.php' through the 'email' and 'Jabber' parameters. An attacker could exploit this flaw to embed malicious script or HTML code in his profile. Then, whenever someo...

WinZip <= 9.0 Multiple Unspecified Overflows

The remote host is using a version of WinZip that is prior to 9.0-SR1. It is, therefore, affected by several buffer overflow flaws that can allow an attacker to execute arbitrary code on the host by convincing a user to open a malformed archive file. C Tenable Network Security, Inc...

UBB.threads editpost.php Number Parameter SQL Injection

According to its banner, the remote host is running a version of UBB.threads that fails to sufficiently sanitize the 'Number' parameter before using it in SQL queries in the 'editpost.php' script. As a result, a remote attacker can pass malicious input to database queries, potentially resulting i...

CopperExport XP_Publish.PHP SQL Injection Vulnerability

The remote host is running CopperExport, a plugin for iPhoto that allows an iPhoto user to export images to a Coppermine gallery. The remote version of this software fails to sanitize unspecified input to the 'xppublish.php' script before using it in a SQL query. Note that successful exploitation...

Stadtaus PHP Form Mail formmail.inc.php Remote File Inclusion

There is a version of Form Mail Script, a PHP script by Ralf Stadtaus, installed on the remote host that suffers from a remote file include vulnerability involving the 'scriptroot' parameter of the 'inc/formmail.inc.php' script. By leveraging this flaw, an attacker may be able to view arbitrary...

SquirrelMail S/MIME Plug-in Remote Command Execution

The S/MIME plugin for SquirrelMail installed on the remote host does not sanitize the 'cert' parameter used by the 'viewcert.php' script. An authenticated user can exploit this flaw to execute system commands remotely in the context of the web server. %NASLMINLEVEL 70300 C Tenable Network Securit...

RaidenHTTPD < 1.1.34 Multiple Remote Vulnerabilities

The remote host is running RaidenHTTPD 1.1.33 or older. Ther are various flaws in the remote version of this server which may allow an attacker to disclose the source code of any PHP file hosted on the remote server, or to execute arbitrary code on the remote with the privileges of the remote...

phpMyAdmin < 2.6.1 pl2 Libraries and Themes Multiple XSS

The installed version of phpMyAdmin suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user input in several PHP scripts used as libraries and themes. A remote attacker may use these issues to cause arbitrary code to be executed in a user's browser, to steal...

Trend Micro VSAPI ARJ Handling Heap Overflow

The remote host is running a version of the Trend Micro engine that has a heap overflow vulnerability in the ARJ handling functions. An attacker may exploit this flaw to bypass virus protection altogether and execute arbitrary code on the remote host. To exploit this flaw, an attacker would need ...

OpenVMS WASD HTTP Server Multiple Vulnerabilities

According to its banner, the remote host appears to be running WASD HTTP server - a web server for the OpenVMS platform. The remote version of this software is affected by various vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security,...

pMachine mail_autocheck.php Arbitrary Code Execution

It is possible to make the remote host include PHP files hosted on a third-party server using the pmachine CGI suite which is installed. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable...

GLSA-200501-12 : TikiWiki: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200501-12 TikiWiki: Arbitrary command execution TikiWiki lacks a check on uploaded images in the Wiki edit page. Impact : A malicious user could run arbitrary commands on the server by uploading and calling a PHP script. Workaroun...

Debian DSA-679-1 : toolchain-source - insecure temporary files

Sean Finney discovered several insecure temporary file uses in toolchain-source, the GNU binutils and GCC source code and scripts. These bugs can lead a local attacker with minimal knowledge to trick the admin into overwriting arbitrary files via a symlink attack. The problems exist inside the...

ArGoSoft Mail Server Multiple Traversals

The remote host is running the ArGoSoft WebMail interface. There are multiple flaws in this interface that may allow an authenticated attacker to read arbitrary files on the remote server and create / delete arbitrary directories on the affected host. %NASLMINLEVEL 70300 C Tenable Network Securit...

ht://Dig htsearch.cgi config Parameter XSS

The remote host is running a version of ht://Dig which is vulnerable to an unspecified cross-site scripting attack. An attacker can exploit this flaw to steal information from unsuspecting users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

IceWarp Web Mail Multiple Flaws (3)

The remote host is running IceWarp Web Mail - a webmail solution available for the Microsoft Windows platform. The remote version of this software is vulnerable to multiple input validation issues that could allow an attacker to compromise the integrity of the remote host. %NASLMINLEVEL 70300 C...