7582 matches found
Cacti: SQL injection
Background Cacti is a complete web-based frontend to rrdtool. Description It has been reported that the "localgraphid" variable used in the file graph.php is not properly sanitized before being processed in an SQL statement. Impact A remote attacker could send a specially crafted request to the...
ftpadmin-multi.txt
FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES by Omni 1 Infos --------- Date : 2007-11-28 Product : FTP Admin Version : v0.1.0 Vendor : http://sourceforge.net/projects/ftpadmin/ Vendor Status : 2007-11-30 Informed! Description : FTP admin is a web-based user administration tool, for usage in...
FTP Admin 0.1.0 (LFI/XSS/AB) Multiple Remote Vulnerabilities
No description provided by source. FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES by Omni 1 Infos --------- Date : 2007-11-28 Product : FTP Admin Version : v0.1.0 Vendor : http://sourceforge.net/projects/ftpadmin/ Vendor Status : 2007-11-30 Informed! Description : FTP admin is a web-based user...
BitDefender Online Anti-Virus Scanner ActiveX OScan8.ocx / OScan8.ocx InitX Method Arbitrary Code Execution
The remote host contains the 'BDSCANONLINE' ActiveX control, used by the BitDefender Online Scanner, a web-based virus scanner. The version of this control installed on the remote host fails to properly validate Unicode values passed to the 'InitX' function as a domain key. If a remote attacker c...
Moderate: Red Hat Security Advisory: conga security, bug fix, and enhancement update
Packages have been updated to include PowerPC and xenU packages. Updated conga packages that fix a security flaw, several bugs, and add enhancements are now available for Red Hat Cluster Suite. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Th...
[Full-disclosure] CVE-2007-3694: Cross site scripting (XSS) in broadcast machine
Source: http://int21.de/cve/CVE-2007-3694-bm.html Cross site scripting XSS in broadcast machine References http://www.getmiro.com/create/broadcast/ https://vulners.com/cve/CVE-2007-3694 Description Cross site scripting describes attacks that allow to insert malicious html or javascript code via g...
Debian DSA-1404-1 : gallery2 - programming error
Nicklous Roberts discovered that the Reupload module of Gallery 2, a web-based photo management application, allowed unauthorized users to edit Gallery's data file. The oldstable distribution sarge does not contain a gallery2 package. The previous gallery package is not affected by this...
[SECURITY] [DSA 1404-1] New gallery2 packages fix privilege escalation
-------------------------------------------------------------------------- Debian Security Advisory DSA 1404-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst November 8th, 2007 http://www.debian.org/security/faq -...
ManageEngine OpManager Login.do Multiple Parameter XSS
The remote host is running ManageEngine OpManager, a web-based network management application. The version of ManageEngine OpManager installed on the remote host fails to sanitize user input to the 'requestid' parameter of the 'jsp/Login.do' script before using it to generate dynamic content. An...
[SECURITY] Fedora 7 Update: phpMyAdmin-2.11.2-1.fc7
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats a nd ...
CodeWidgets Web Based Alpha Tabbed Address Book Index.ASP SQL注入漏洞
CodeWidgets Web Based Alpha Tabbed Address Book是一款基于ASP的WEB应用程序。 CodeWidgets Web Based Alpha Tabbed Address Book不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于'index.asp'脚本对用户提交的'alpha'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 CodeWidgets Web Based Alpha Tabbed Address Book...
Debian DSA-1389-2 : zoph - missing input sanitising
It was discovered that zoph, a web-based photo management system, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1389...
wba-sql.txt
http://Aria-Security.Net ------------------------------------ Web based alpha tabbed address book SQL Injection codewidgets.com Poc index.asp?alpha='SQL INJECTION Credits Goes To Aria-Security Team Regards, The-0utl4w...
Aria-Security.Net [Web based alpha tabbed address book SQL Injection]
http://Aria-Security.Net ------------------------------------ Web based alpha tabbed address book SQL Injection codewidgets.com Poc index.asp?alpha='SQL INJECTION Credits Goes To Aria-Security Team Regards, The-0utl4w...
DSA-1389-2 zoph - SQL injection
Bulletin has no description...
CodeWidgets Web Based Alpha Tabbed Address Book - 'index.asp' SQL Injection
source: https://www.securityfocus.com/bid/26193/info CodeWidgets Web Based Alpha Tabbed Address Book is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...
DEBIAN-CVE-2007-5380
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...
Cisco Unified Communications管理应用程序特权提升漏洞
Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications管理应用程序包含的基于WEB的工具存在访问验证问题，远程攻击者可以利用漏洞访问设备敏感信息和更改应用程序配置。 Cisco Unified ICME, Unified ICMH, UCCE,...
Cisco Security Advisory: Cisco Unified Communications Web-based Management Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Web-based Management Vulnerability Document ID: 97836 Advisory ID: cisco-sa-20071017-IPCC http://www.cisco.com/warp/public/707/cisco-sa-20071017-IPCC.shtml Revision 1.0 For Public Release 2007...