Novell Netware Enterprise Web Server is vulnerable to cross-site scripting attacks, information disclosure, and file uploads. An attacker can exploit this vulnerability by sending a specially crafted URL to the vulnerable server, which will allow the attacker to execute arbitrary JavaScript code, disclose sensitive information, and upload malicious files.
Finjan SurfinGate is prone to a vulnerability that may permit remote attackers to execute certain management commands (using the FHTTP protocol) through the management control port (3141/TCP). It has been reported that commands could be issued to restart the server, most likely resulting in a denial of service.
It has been reported that Netbus may be prone to a a directory listings disclosure and file upload vulnerability that may allow and attacker to disclose sensitive information and the possibility of corrupting files on the system or placing files such as malicious files in directories where they may be interpreted.
thttpd is prone to a cross-site scripting vulnerability in the CGI test script. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.
A vulnerability has been reported to exist in the Apache mod_perl module that may allow local attackers to gain access to privileged file descriptors. This issue could be exploited by an attacker to hijack a vulnerable server daemon. Other attacks are also possible. It has been reported that multiple file descriptors, are leaked to the mod_perl module and any processes it creates. This allows for Perl scripts and any processes they spawn to access the privileged I/O streams.
phpunity.postcard is vulnerable to a remote file inclusion vulnerability due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a malicious URL to the vulnerable application. This can result in remote code execution.
Mephistoles 'httpd' daemon fails to sanitize user-supplied input, making it vulnerable to cross-site scripting attacks. This vulnerability allows an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the affected server.
It has been reported that WebcamXP may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. It has been reported that HTML and script code may be parsed via a malicious URI. Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.
It has been reported that the software is allegedly prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is reported to exist in the 'wralogin' authentication form that is accessed through the HTTPS (SSL) interface. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.
It has been reported that various DUware products may be prone to an access validation issue allowing a remote attacker to gain access to sensitive resources by bypassing authentication. An arbitrary file upload vulnerability has been specified in DUpics that may allow a remote attacker to upload files to a vulnerable system. Successful exploitation of these issue may allow an attacker to gain unauthorized access to sensitive resources and upload arbitrary files to the host. An attacker can exploit this vulnerability to upload malicious applications to the vulnerable system. The following products are affected: DUclassified, DUdirectory, DUdownload, DUgallery, DUpics, DUportal. The following URLs are vulnerable to the arbitrary file upload vulnerability: http://www.example.com/admin/inc_add.asp, http://www.example.com/admin/inc_edit.asp?iPic=500, http://www.example.com/admin/inc_pics.asp, http://www.example.com/admin/inc_type.asp. Exploitation of this issue may result in the compromise of the affected system.
Services By CQR