FileExecutive v1.0.0 Multiple Vulnerabilities

Exploit for unknown platform in category web applications ============================================= FileExecutive v1.0.0 Multiple Vulnerabilities ============================================= ============================================================================== » FileExecutive...

FileExecutive File Disclosure / Path Disclosure / Shell Upload

============================================================================== » Thx To : Jiko ,H.Scorpion ,Dr.Bahy ,T3rr0rist ,Golden-z3r0 ,Shr7 Team . ============================================================================== » FileExecutive Multiple Vulnerabilities...

Debian DSA-1901-1 : mediawiki1.7 - several vulnerabilities

Several vulnerabilities have been discovered in mediawiki1.7, a website engine for collaborative work. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-5249 David Remahl discovered that mediawiki1.7 is prone to a cross-site scripting attack. -...

Debian DSA-1978-1 : phpgroupware - several vulnerabilities

Several remote vulnerabilities have been discovered in phpgroupware, a Web-based groupware system written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-4414 A SQL injection vulnerability was found in the authentication module. -...

Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2

Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers two security issues that have recently been fixed in the Bugzilla code: + Some files stored on the web server are not correctly protected against external access and can ...

Invision Power Board 1.3.1 and lower Versions SQL injection vulnerability-vulnerability warning-the black bar safety net

Invision Power Board is a widely used WEB-based program. Invision Power Board there is an input validation vulnerability, a remote attacker could exploit this to performSQL injectionattack. Due to not be able to properly filter user-supplied data, an attacker may by the st parameter in the Insert...

Google Apps googleapps.url.mailto URI Argument Injection

Google Apps is a set of web-based tools hosted by Google under the software-as-a-service model. It features several Web applications with similar functionality to popular office suites, including: Gmail, Google Calendar, Google Chrome, Talk, Docs and Sites. When using Google Apps, the data and...

[SECURITY] Fedora 11 Update: zabbix-1.6.8-1.fc11

ZABBIX is software that monitors numerous parameters of a network and the health and integrity of servers. ZABBIX uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. ZABBIX offers...

[SECURITY] Fedora 12 Update: zabbix-1.6.8-1.fc12

ZABBIX is software that monitors numerous parameters of a network and the health and integrity of servers. ZABBIX uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. ZABBIX offers...

HP Power Manager formExportDataLogs buffer overflow

Added: 01/22/2010 CVE: CVE-2009-3999 BID: 37867 OSVDB: 61848 Background HP Power Manager is a web-based application that enables administrators to manage an HP UPS from a browser-based management console. Problem A buffer overflow vulnerability HP Power Manager allows remote attackers to execute...

HP Power Manager formExportDataLogs buffer overflow

Added: 01/22/2010 CVE: CVE-2009-3999 BID: 37867 OSVDB: 61848 Background HP Power Manager is a web-based application that enables administrators to manage an HP UPS from a browser-based management console. Problem A buffer overflow vulnerability HP Power Manager allows remote attackers to execute...

LetoDMS Local File Inclusion / Cross Site Request Forgery

SEC Consult Security Advisory ======================================================================== title: Local file inclusion/execution and multiple Cross-Site-Request-Forgery vulnerabilities in LetoDMS formerly MyDMS products: LetoDMS formerly MyDMS vulnerable version: LetoDMS formerly MyDM...

phpLDAPadmin < 1.2 Local File Inclusion

Binary data 5291.prm...

WingFTP 3.2.4 Cross Site Request Forgery

Application: WingFTP Server 3.2.4 maybe earlier versions too Link: http://www.wftpserver.com/ Vulnerability: CSRF Author: Ams Contact: mail: ax330d at gmail dot com site: http://www.0x416d73.name/ 1. About software "Wing FTP server is not only a FTP server. It's a multi-protocol file serverFTP,...

WingFTP Server v3.2.4 CSRF Vulnerability

Exploit for unknown platform in category web applications ======================================== WingFTP Server v3.2.4 CSRF Vulnerability ======================================== Application: WingFTP Server 3.2.4 maybe earlier versions too Link: http://www.wftpserver.com/ Vulnerability: CSRF...

Wing FTP Server 3.2.4 - Cross-Site Request Forgery

Wing FTP Server 3.2.4 - Cross-Site Request Forgery Application: WingFTP Server 3.2.4 maybe earlier versions too Link: http://www.wftpserver.com/ Vulnerability: CSRF Author: Ams Contact: mail: ax330d at gmail dot com site: http://www.0x416d73.name/ 1. About software "Wing FTP server is not only a...

Trac文本格式报表信息泄露漏洞

CVECAN ID: CVE-2009-4405 Trac是用Python编写的基于Web的事件跟踪系统。 Trac在生成逗号分隔或制表符分隔的文本格式报表时没有正确地强制某些策略，用户无需必要的权限就可以从故障单中访问敏感信息。 Edgewall Software Trac 0.11.6 厂商补丁： Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE...

PHP-Calendar configfile变量远程文件包含漏洞

CVECAN ID: CVE-2009-3702 php-Calendar是一款基于WEB的日历事务系统。 PHP-Calendar中存在多个绝对路径遍历漏洞，远程攻击者可以通过在提交给update08.php或update10.ph的configfile参数中的完整路径名导致包含并执行任意本地文件。以下是有漏洞的代码段： 36 elseif!empty$GET'configfile' 37 iffileexists$GET'configfile' 38 requireonce$GET'configfile'; PHP-Calendar 1.1 临时解决方法：...

[SECURITY] Fedora 11 Update: phpldapadmin-1.2.0.4-1.fc11

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

SQL-Ledger 'admin.pl' Empty Credentials

The remote web server is hosting SQL-Ledger, a web-based double-entry accounting system. The installed version does not require credentials to access the administrator interface. Note that the installed version is potentially affected by several other vulnerabilities, though Nessus has not tested...