WebTitan < 3.60 - Local File Inclusion

Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. dot dot in the fname parameter in a view action. id: CVE-2011-4640 info: name: WebTitan 3.60 - Local File Inclusion author: ctflearner severity:...

EUVD-2014-2987

Malware in sbrugna...

CVE-2020-11698

An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server...

SpamTitan Command Injection Vulnerability

SpamTitan is an anti-spam solution from C/o Copperfasten, Ireland. The solution is characterized by easy installation and simple configuration. A command injection vulnerability exists in SpamTitan 7.07. The vulnerability stems from improper input validation of the community parameter in...

SpamTitan Arbitrary File Read Vulnerability

SpamTitan is an anti-spam solution from C/o Copperfasten, Ireland. The solution is characterized by easy installation and simple configuration. An arbitrary file read vulnerability exists in SpamTitan 7.07. The vulnerability stems from improper validation of the fname parameter in certs-x.php. An...

CVE-2020-11699

CVE-2020-11699 affects Titan SpamTitan 7.07. The issue is improper validation of the fname parameter on certs-x.php, enabling remote code execution on the target server when an authenticated user interacts with that page. Documented impact indicates attacker-controlled input could trigger code ex...

CVE-2020-11699: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Titan SpamTitan 7.07. Improper validation of the parameter fname on the page certs-x.php would allow an attacker to execute remote code on the target server. The user has to be authenticated before interacting with this page...

CVE-2020-11698: Improper Neutralization of Special Elements used in a Command

An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server...

CVE-2020-11700: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter fname, used on the page certs-x.php, would allow an attacker to retrieve the contents of arbitrary files. The user has to be authenticated before interacting with this page...

CVE-2019-19016: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injection through the results parameter. This could be used by an attacker to extract sensitive information from the appliance database...

Cross site scripting

Cross-site scripting XSS vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter...

CVE-2014-2965

CVE-2014-2965 is a reflected XSS in SpamTitan’s management interface, affecting auth-settings-x.php prior to version 6.04. The vulnerability allows an attacker to inject arbitrary script via the sortdir parameter, executing in a user’s browser context. SpamTitan addressed this with a 6.04 patch; ...

CVE-2014-2965: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter...

Sql injection

SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter...

CVE-2014-4306

CVE-2014-4306 affects WebTitan (logs-x.php) prior to 4.04, where a directory traversal via the logfile parameter in a download action allows remote attackers to read arbitrary files by using .. in the request. This is confirmed across multiple sources (Red Hat, NVD, OpenVAS reference), tying the ...

CVE-2014-4307

SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter...

CVE-2014-4306

Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. dot dot in the logfile parameter in a download action...

CVE-2014-4307: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter...

CVE-2014-4306: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. dot dot in the logfile parameter in a download action...

CVE-2011-4638

Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to login-x.php, and allow remote authenticated users to execute arbitrary SQL commands via the 2 bldomain, 3 wldomain, or 4 temid paramete...