apache2: Fixed several security issues (important)

This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack CVE-2011-3192 was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded,...

CVE-2011-4273

Multiple cross-site scripting XSS vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via 1 the group parameter to goform/AddGroup, related to addgroup.asp; 2 the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the 3 user aka...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via 1 the group parameter to goform/AddGroup, related to addgroup.asp; 2 the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the 3 user aka...

CVE-2011-4273

CVE-2011-4273 affects Embedthis GoAhead WebServer 2.18. The vulnerability is a set of cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary web script or HTML via: (1) the group parameter to goform/AddGroup (addgroup.asp), (2) the url parameter to goform/AddAccessLimit...

CVE-2011-4273

Multiple cross-site scripting XSS vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via 1 the group parameter to goform/AddGroup, related to addgroup.asp; 2 the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the 3 user aka...

CVE-2011-4273: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via 1 the group parameter to goform/AddGroup, related to addgroup.asp; 2 the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the 3 user aka...

PT-2011-4920

Name of the Vulnerable Software and Affected Versions GoAhead Webserver version 2.18 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include:...

vBulletin 4.1.7 - Multiple Remote File Inclusions

vBulletin 4.1.7 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/50455/info vBulletin is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially...

phpAlbum Multiple Security Vulnerabilities

phpAlbum is prone to an arbitrary-file-download vulnerability, multiple cross-site scripting vulnerabilities, and multiple PHP code- injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these issues to execute arbitrary script code in the...

vBulletin 4.1.7 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/50455/info vBulletin is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary scri...

phpAlbum Multiple Security Vulnerabilities

phpAlbum is prone to an arbitrary-file-download vulnerability, multiple cross-site scripting vulnerabilities, and multiple PHP code- injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these issues to execute arbitrary script code in the...

RuubikCMS 'f' Parameter Information Disclosure Vulnerability

RuubikCMS is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attack...

Alsbtain Bulletin 1.51.6 - Multiple Local File Inclusions

Alsbtain Bulletin 1.51.6 - Multiple Local File Inclusions source: https://www.securityfocus.com/bid/50350/info Alsbtain Bulletin is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain...

Alsbtain Bulletin 1.5/1.6 - Multiple Local File Inclusions

source: https://www.securityfocus.com/bid/50350/info Alsbtain Bulletin is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary...

ABUS TVIP 11550/21550 Multiple vulnerabilities (and possibly other ABUS cams)

Title : ABUS TVIP 11550/21550 Multiple vulnerabilities and possibly other ABUS cams Author : Marco van Berkum - Summary - Arbitrary file read - Arbitrary file upload - Arbitrary command excution input validation bug - How it's totally compromised including ssh root login. - Summary The ABUS 11550...

POSH Local File Include and Cross Site Scripting Vulnerabilities

POSH is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user- supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the contex...

2Moons 1.4 - Multiple Remote File Inclusions

2Moons 1.4 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/50046/info 2Moons is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow a remote attacker to obta...

2Moons 1.4 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/50046/info 2Moons is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow a remote attacker to obtain sensitive information or execute arbitrary...

GoAhead Web Server 2.18 - addgroup.asp?group Cross-Site Scripting

GoAhead Web Server 2.18 - addgroup.asp?group Cross-Site Scripting source: https://www.securityfocus.com/bid/50039/info GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied...

GoAhead Web Server 2.18 - 'adduser.asp' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/50039/info GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser...