Spyce 2.1.3 - 'spyce/examples/getpost.spy?Name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

Spyce 2.1.3 - spyce/examples/automaton.spy Direct Request Error Message Information Disclosure

source: https://www.securityfocus.com/bid/27898/info Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

DotClear Full Path Disclosure Vulnerability

I have contacted the developers 2 weeks ago, still no answer... Vendor: DotClear Vulnerable: DotClear 1.2.5 and below Release Date: 2007-01-28 Full Path Disclosure This vulnerability affects: http://www.example.com/dotclear/themes/default/form.php...

MediaWiki Full Path Disclosure Vulnerability

Vendor: MediaWiki Vulnerable: MediaWiki 1.9.1 and below Bugtraq ID: Secunia Advisory: Release Date: 2007-01-29 Full Path Disclosure This vulnerability affects all the default skins: http://www.example.com/wiki/skins/Simple.deps.php http://www.example.com/wiki/skins/MonoBook.deps.php...

WebRoot SpySweeper protection bypass

Content is blocked only by filename. Multiple archive formats are not supported...

CVE-2006-6959

WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys...

CVE-2006-6961

WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name...

CVE-2006-6960

The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with 1 RAR, 2 GZ, 3 TAR, 4 CAB, or 5 ACE compression...

CVE-2006-6959

WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys...

CVE-2006-6961

WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name...

CVE-2004-2676

The Spy Sweeper Enterprise Client SpySweeperTray.exe in WebRoot Spy Sweeper before 2.0 does not drop privileges when using the help functionality, which allows local users to gain privileges...

CVE-2006-6959

The CVE-2006-6959 entry concerns WebRoot Spy Sweeper (4.5.9 and earlier). The vulnerability allows local users to bypass the Startup-Shield security restrictions by modifying certain registry keys, i.e., a local-privilege impact via registry edits. The available documents specify the affected pro...

CVE-2006-6960

The CVE concerns WebRoot Spy Sweeper (Compression Sweep) prior to version 4.5.9 failing to handle non-ZIP archives. Specifically, the feature does not process archives in RAR, GZ, TAR, CAB, or ACE formats, which can allow remote attackers to bypass malware detection. Affected component: Compressi...

CVE-2006-6961

WebRoot Spy Sweeper 4.5.9 and earlier fails to detect malware based on file contents, allowing remote attackers to bypass malware detection by renaming a file. Connected documents specify that detection is blocked only by filename and that multiple archive formats are not supported. Affected prod...

CVE-2006-6960

The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with 1 RAR, 2 GZ, 3 TAR, 4 CAB, or 5 ACE compression...

CVE-2006-6959: Undefined Security Weakness

WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys...

CVE-2006-6961: Undefined Security Weakness

WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name...

CVE-2004-2676: Undefined Security Weakness

The Spy Sweeper Enterprise Client SpySweeperTray.exe in WebRoot Spy Sweeper before 2.0 does not drop privileges when using the help functionality, which allows local users to gain privileges...

CVE-2006-6960: Undefined Security Weakness

The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with 1 RAR, 2 GZ, 3 TAR, 4 CAB, or 5 ACE compression...

CVE-2006-5031: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, followed by a filename ending with "%00" and a .js filename...