CGI RESCUE WebFORM allows unauthorized email transmission

Overview WebFORM from CGI RESCUE is software which delivers the HTML form inputs via email. WebFORM fails to check the mail headers properly, allowing a remote attacker to send email to arbitrary addresses. According to the vendor's information, FORM2MAIL also contains a similar vulnerability, an...

DEBIAN-CVE-2007-4174

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...

[Full-disclosure] PacSec Hype Security Team: CGI.pm param injection

====================================================================== PacSec Hype Security Team param injection in CGI.pm and inheritors allows SQL injection and manipulation of data bypassing many perl web form validators ======================================================================...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 is affected. The vulnerability arises from improper processing of the $keyword variable in the netaddressbook.php form, causing ldap_search failures to reveal the local path via ldaplib.php error messages. This leads to information disclosure through invalid characte...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering 1 invalid characters such as "" or 2 a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldapsearch...

CVE-2003-1282

IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords by causing the 1 $DTWCURRENTFILENAME, 2 $DATABASE, 3 $LOGIN, 4 $PASSWORD, and possibly other predefined variables that can be echoed back to the user via a w...

CVE-2003-1282

CVE-2003-1282 affects IBM Net.Data. The issue allows remote attackers to disclose sensitive information by causing predefined variables such as $(DTW_CURRENT_FILENAME), $(DATABASE), $(LOGIN), and $(PASSWORD) to be echoed back through a web form. This creates potential exposure of file paths, serv...

Mall23 - AddItem.asp SQL Injection

Mall23 - AddItem.asp SQL Injection source: https://www.securityfocus.com/bid/14898/info Mall23 is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of t...

[PersianHacker.NET 200503-09]PHPOpenChat v3.x XSS Multiple Vulnerability

PersianHacker.NET 200503-09PHPOpenChat v3.X XSS Multiple Vulnerability Date: 2005 March Bug Number: 09 PHPOpenChat is a high performance php-based chat server software for a live chat-room or -module on every php-based site. More info @: http://phpopenchat.org/ Discussion: -------------------- Th...

BizMail 2.1 Spam Exploit

Greetings all, Over the course of the last few months I've been the victim of repeated abuses of a web-based form commonly used for customer requests. This form can be downloaded here : http://www.bizmailform.com This form allowed a hacker to directly call the cgi, forge a referer url, and, with...

CVE-2003-1282

IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords by causing the 1 $DTWCURRENTFILENAME, 2 $DATABASE, 3 $LOGIN, 4 $PASSWORD, and possibly other predefined variables that can be echoed back to the user via a w...

CVE-2001-1281

Web Messaging Server for Ipswitch IMail 7.04 and earlier allows remote authenticated users to change information for other users by modifying the olduser parameter in the "Change User Information" web form...

CVE-2001-0096

CVE-2001-0096 describes a denial-of-service flaw in Microsoft IIS FrontPage Server Extensions (FPSE) on IIS 4.0/5.0, where a remote attacker can crash the server via a malformed web form submission. OpenVAS/Nessus classify this as a remote DoS that renders the service unusable. Public references ...

Leif M. Wright simplestmail.cgi 1.0 - Remote Command Execution

Leif M. Wright simplestmail.cgi 1.0 - Remote Command Execution source: https://www.securityfocus.com/bid/2102/info A vulnerabiliy exists in Leif M. Wright's simplestmail.cgi, a script designed to coordinate email responses from web forms. An insecurely-structured call to the open function leads t...