10604 matches found
Design/Logic Flaw
The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...
Tribisur - 'cat' Cross-Site Scripting
source: https://www.securityfocus.com/bid/37800/info Tribisur is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...
Code injection
Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service daemon crash via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word...
CVE-2009-4587
Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service daemon crash via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word...
CVE-2009-4572
Cross-site request forgery CSRF vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI...
Cross site scripting
Cross-site scripting XSS vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in an order/orderprint action to the default URI...
Sql injection
SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/...
CVE-2009-4570
Cross-site scripting XSS vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in an order/orderprint action to the default URI...
CVE-2009-4569
SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/...
Cross site request forgery (csrf)
Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service configuration reset via a request to a crafted URI...
CVE-2009-3734
Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service configuration reset via a request to a crafted URI...
Auto-Host 2 Cross Site Scripting
======================================================================================== | Title : Auto-Host 2 Multi Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | Total alerts found : 2 | High : 1 |...
Code injection
InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs...
CVE-2009-4530
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI...
Design/Logic Flaw
httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . dot character to the URI...
CVE-2009-4531
httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . dot character to the URI...
CVE-2009-4535
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / slash character to the URI...