2052 matches found
Dispair 0.10.2 - Remote Command Execution
Dispair 0.10.2 - Remote Command Execution source: https://www.securityfocus.com/bid/5392/info Dispair fails to sufficiently validate user-supplied input before it is passed to the shell via the Perl open function. Remote attackers may potentially exploit this issue to execute arbitrary commands o...
Dynamic Guestbook V3.0 Cross Site Scripting and Arbitrary Command Execution under certain circumstances
------------------------------------------------------------- itcp advisory 7 [email protected] http://www.it-checkpoint.net/advisory/7.html April 3rd, 2002 ------------------------------------------------------------- Dynamic Guestbook V3.0 Cross Site Scripting and Arbitrary Command...
Jana Server does not adequately validate user input thereby allowing directory traversal
Overview Jana Server contains a directory traversal vulnerability. Description Versions 1.4x of Jana Server, a web server for Windows developed by T. Hauck, do not properly filter requests for hexadecimal encodings of ".." dot-dot and allows directory traversal out of the HTTP document root...
Progress Software suid overflows again.
Yet another b0f in progress software due to pstcopy Progress Software corp. http://www.progress.com STILL can't seem to validate user input... this is in their latest patch level for Progress 9.1C 91C09.tar.Z root@localhost bin cat ../version echo PROGRESS PATCH Version 9.1C09 as of February 26,...
PostNuke Bugged
Hi everyone, this post is 4 weeks after the original information was made available to the developers, allowing time for many effected users to patch and also the developers to fix / check newer versions. --------- rookidd found another set of vulnerabilities in postnuke, this time in version 7.0...
SunSolve CD cgi scripts...
Sun never responded to this mail so I guess they don't consider the bug too be serious ... could be worth mentioning though. ----- Forwarded message from Fyodor [email protected] ----- Date: Sat, 16 Jun 2001 23:24:45 +0700 From: Fyodor [email protected] To: [email protected] Subject:...
Xoops topics : One more time
Hi again, I just found an other Script injection issue in Xoops Private Message Box. http://xooped-site/pmlite.php?touserid=USERIDOFTARGET&msgid=&image=fo o.gif'scriptalert"test";/scriptimg20src='http://www.isecurelabs.com /images/barre.jpg&op=submit&theme=snow&subject=Are you sure...
Caldera UnixWare 7.1.1 - WebTop SCOAdminReg.cgi Arbitrary Command Execution
Caldera UnixWare 7.1.1 - WebTop SCOAdminReg.cgi Arbitrary Command Execution source: https://www.securityfocus.com/bid/3936/info UnixWare is a commercial Unix implementation distributed originally developed by SCO. It is now maintained and distributed by Caldera. The scoadminreg.cgi program does n...
Caldera UnixWare 7.1.1 - WebTop 'SCOAdminReg.cgi' Arbitrary Command Execution
source: https://www.securityfocus.com/bid/3936/info UnixWare is a commercial Unix implementation distributed originally developed by SCO. It is now maintained and distributed by Caldera. The scoadminreg.cgi program does not properly validate user input when executed with the -c option. Because of...
Модификация SQL-запроса во многих модулях авторизации Apache, PAM и т.д.
Ввод пользователя не проверяется на наличие служебных символов SQL...
phpBB does not adequately validate user input thereby allowing user to gain escalated privileges via manipulated SQL query
Overview phpBB is an open-source bulletin board program. There exists a user input validation problem with regard to the parsing of the URL. An intruder can excute limited SQL queries and gain administrative privileges on the bulletin board. Description phpBB has a user input validation problem...
phpBB does not adequately validate user input for language selection thereby allowing user to execute arbitrary php code
Overview phpBB is an open-source bulletin board program. A user input validation problem exists with regard to language settings. An intruder can excute arbitrary php code and gain a shell with the privileges of the web server on the system. Description Version 1.4.0 and earlier have a user input...
Allaire JRun Java Application Server vulnerable to Cross-Site Scripting via passing of user input directly to default error page
Overview Web Servers that use the Allaire JRun Java Servlet Container are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or scriptJavaScript, VBScript, Java, etc. in a dynamically generated page based on unvalidated input from...
Дырка в AdCycle
Недостаточная проверка ввода опльзователя при составлении SQL-запроса...
Дырка в bugzilla (shell metacharacters)
Недостаточная проверка ввода пользователя приводит к возможности выполнения команд на сервере...
Очередные дырки в CGI
Недостаточная проверка ввода пользователя при вызове внешней программы...
Microburst uStorekeeper 1.x - Arbitrary Commands
Microburst uStorekeeper 1.x - Arbitrary Commands source: https://www.securityfocus.com/bid/2536/info A vulnerability exists in versions of uStorekeeper Online Shopping System from Microburst Technologies. The script fails to properly validate user-supplied input, allowing remote users to submit...
Free Online Dictionary of Computing 1.0 - Remote File Viewing
Free Online Dictionary of Computing 1.0 - Remote File Viewing source: https://www.securityfocus.com/bid/2484/info A vulnerability exists in a CGI script called "The Free Online Dictionary of Computing". Due to a failure to properly validate user supplied input, a remote attacker can compose and...