1355 matches found
[SECURITYREASON.COM] SQL injection and XSS in paFileDB
-= SecurityReason-2005-SRA03 =- -= SQL injection and XSS in paFileDB =- Author: sp3x Date: 12 March 2005 Affected software : =================== paFileDB version : =3.1 Description : ============= paFileDB is designed to allow webmasters have a database of files for download on their site. To add...
PHP/ASP/CGI web applications security bugs
PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...
UBBCentral UBB.Threads 6.2.36.5 - login.php?Cat Cross-Site Scripting
UBBCentral UBB.Threads 6.2.36.5 - login.php?Cat Cross-Site Scripting source: https://www.securityfocus.com/bid/11900/info It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize...
Goolery 0.3 - viewpic.php?conversation_id Cross-Site Scripting
Goolery 0.3 - viewpic.php?conversationid Cross-Site Scripting source: https://www.securityfocus.com/bid/11587/info It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI...
MoniWiki < 1.0.9 wiki.php XSS
The remote host seems to be running MoniWiki, a wiki web application written in PHP. The remote version of this software is vulnerable to cross-site scripting attacks, through the script 'wiki.php'. With a specially crafted URL, an attacker can cause arbitrary code execution in users' browsers...
CGI bugs
No description provided...
Emulive Server4 Authentication Bypass
The remote host is running EmuLive Server4, a web and media streaming server. There is a flaw in the administrative interface that allows a remote attacker to bypass the authentication procedure by requesting the page '/public/admin/index.htm' directly. An attacker may exploit this flaw to gain...
Web-APP.Org WebAPP 0.8/0.9.x - Directory Traversal
source: https://www.securityfocus.com/bid/11028/info WebAPP is reported prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input data. An attacker can exploit this vulnerability to retrieve arbitrary, potentially sensitive files from the...
Barracuda Web Application Firewall Detection
Binary data 5060.prm...
BasiliX Application Detection
The remote host is running BasiliX, a webmail application based on PHP and IMAP and powered by MySQL. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See the Nessus Scripts License for details. Changes by Tenable: - Revised plugin title 12/28/10 include'deprecatednasllevel.inc'...
phpGedView Arbitrary File Access / Remote File Inclusion
A vulnerability exists in the installed version of PhpGedView that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. Another vulnerability could allow an attacker to include arbitrary PHP files hosted on a third-party website. %NASLMINLEVE...
AtomicBoard Multiple Remote Vulnerabilities (Traversal, Path Disc)
The remote host is running AtomicBoard, a weblog and message board system written in PHP. A directory traversal vulnerability exists in the 'location' parameter of the 'index.php' file. An attacker could exploit this in order to read arbitrary files subject to the privileges of the web server...
Lucent VitalNet VsSetCookie.exe Unauthorized Access
The VsSetCookie.exe CGI exists on the remote web server. Some versions of this file have an unauthorized access vulnerability. Making a request similar to : http://www.example.com/cgi-bin/VsSetCookie.exe?vsuser= will result in full access if a valid username is provided. Please note Nessus solely...
OneOrZero Security Problems (PHP)
Informations : °°°°°°°°°°°°°° Website : http://www.oneorzero.com Version : 1.4 rc4 Problems : - SQL Injection - Admin Access PHP Code/Location : °°°°°°°°°°°°°°°°°°° supporter/tupdate.php : -------------------------------------------------------------------------- if$groupid == 'change' $sql =...
Horde IMP mailbox.php3 Multiple Parameter SQL Injection
The remote server is running IMP, a web-based mail client. There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script. An attacker may use this flaw to gain unauthorized access to a user mailbox or...
PHP-Nuke Detection
The remote host is running a copy of PHP-Nuke. Given the insecurity history of this package, the Nessus team recommends that you do not use it but use something else instead, as security was clearly not in the mind of the persons who wrote it. The author of PHP-Nuke Francisco Burzi even started t...
vAuthenticate 2.8 - SQL Injection
source: https://www.securityfocus.com/bid/6605/info A vulnerability has been discovered in vAuthenticate. It has been reported that various PHP scripts used by vAuthenticate are prone to SQL injection attacks. This issue may be exploited by an unauthorized attacker to view protected web pages. An...
PHPRank 1.8 - add.php Cross-Site Scripting
PHPRank 1.8 - add.php Cross-Site Scripting source: https://www.securityfocus.com/bid/5945/info phpRank is a freely available web site link sharing script. It is available for Unix, Linux, and Microsoft operating systems. It has been reported that phpRank is vulnerable to cross-site scripting...
DB4Web 3.4/3.6 - File Disclosure
source: https://www.securityfocus.com/bid/5723/info DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms. A directory traversal bug exists i...
CVE-2002-0752
Technical details for CVE-2002-0752 are not publicly provided in the supplied documents. Monitor for updates from connected sources to obtain affected product/version, impact, or remediation information.