Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 id, 3 num, 4 board, 5 cat, 6 real, 7 viewcat, 8 img, or 9 curcatname parameter in cgi-bin/index.cgi, or 10 vsSD parameter in...

CVE-2006-1427

Multiple cross-site scripting XSS vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 id, 3 num, 4 board, 5 cat, 6 real, 7 viewcat, 8 img, or 9 curcatname parameter in cgi-bin/index.cgi, or 10 vsSD parameter in...

CVE-2006-1427

CVE-2006-1427 involves multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier. The affected component is the web application’s CGI interfaces, specifically cgi-bin/index.cgi (parameters: action, id, num, board, cat, real, viewcat, img, curcatname) and /mods/calendar/i...

CVE-2006-1427

Multiple cross-site scripting XSS vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 id, 3 num, 4 board, 5 cat, 6 real, 7 viewcat, 8 img, or 9 curcatname parameter in cgi-bin/index.cgi, or 10 vsSD parameter in...

CVE-2006-1427: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 id, 3 num, 4 board, 5 cat, 6 real, 7 viewcat, 8 img, or 9 curcatname parameter in cgi-bin/index.cgi, or 10 vsSD parameter in...

Gallery: Cross-site scripting vulnerability

Background Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers. Description Peter Schumacher discovered that Gallery fails to...

Trac: Cross-site scripting vulnerability

Background Trac is a minimalistic web-based project management, wiki and bug tracking system including a Subversion interface. Description Christophe Truc discovered that Trac fails to properly sanitize input passed in the URL. Impact A remote attacker could exploit this to inject and execute...

WebAPP Apage.CGI remote command execution flaw

Due to a lack of user input validation, an attacker can exploit the SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[Full-disclosure] [ GLSA 200506-13 ] webapp-config: Insecure temporary file handling

Gentoo Linux Security Advisory GLSA 200506-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Gentoo Linux webapp-config symbolic links problem

Symbolic links problem on temporary files creation...

GLSA-200506-13 : webapp-config: Insecure temporary file handling

The remote host is affected by the vulnerability described in GLSA-200506-13 webapp-config: Insecure temporary file handling Eric Romang discovered webapp-config uses a predictable temporary filename while processing certain options, resulting in a race condition. Impact : Successful exploitation...

Gentoo Webapp-Config 1.10 - Insecure File Creation

Gentoo Webapp-Config 1.10 - Insecure File Creation source: https://www.securityfocus.com/bid/13780/info Gentoo webapp-config is prone to an insecure file creation vulnerability. This issue is due to a design error that causes the application to fail to verify the existence of a file before writin...

Gentoo Webapp-Config 1.10 - Insecure File Creation

source: https://www.securityfocus.com/bid/13780/info Gentoo webapp-config is prone to an insecure file creation vulnerability. This issue is due to a design error that causes the application to fail to verify the existence of a file before writing to it. An attacker may leverage this issue to cau...

CVE-2005-1707

The fnshowpostinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file...

CVE-2005-1707

CVE-2005-1707 affects Gentoo webapp-config, where the fn_show_postinst function can be abused via a symlink attack on the temporary file postinst.txt. This race condition could let a local attacker overwrite arbitrary files with the privileges of the webapp-config user, potentially disrupting ope...

CVE-2005-1707

The fnshowpostinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file...

CVE-2005-1707: Undefined Security Weakness

The fnshowpostinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file...

[UNIX] WebApp Arbitrary Code Execution (apage.cgi, Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

webapp-config-05182005.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gentoo webapp-config insecure temporary file creation Vendor: http://www.gentoo.org Advisory: http://www.zataz.net/adviso/webapp-config-05182005.txt Vendor informed: yes Exploit available: yes Impact : high Exploitation : low Gentoo webapp-config...

WebAPP 0.9.9.2.1 - Remote Command Execution (2)

WebAPP 0.9.9.2.1 - Remote Command Execution 2 ?php WebAPP v0.9.9.2.1 Remote Command Execution Exploit Code by Nikyt0x [email protected] Advisory: www.defacers.com.mx/advisories/3.txt Saludos: Soulblack Staff, Status-x, NeosecurityTeam, KingMetal, Trespasser... sbwebapp.php www.host.com...