A remote file include vulnerability has been reported for Zentrack. Due to insufficient sanitization of some user-supplied variables by the 'index.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL. If the remote file is a malicious PHP script, this may allow for the execution of attacker-supplied PHP code with the privileges of the web server. Successful exploitation may provide unauthorized remote access to the attacker. This issue may also be exploited to remotely view files on the vulnerable host.
An attacker can cause a denial of service to legitimate users of the HTTP service by sending a malformed packet containing an invalid Transfer-Encoding header. This can be done by using telnet to connect to the target server on port 80 and sending a GET request with the Transfer-Encoding header set to "Chunked" followed by a string of "A" characters.
It has been reported that Xaos is vulnerable to a boundary condition error in the command option processing. Because of this, an attacker may be able to gain elevated privileges, potentially compromising the integrity of the host.
MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An attacker may execute arbitrary script code in the security context of the system running MaxWebPortal. MaxWebPortal has been reported prone to insecure hidden form field vulnerability. An attacker may save the 'start new topic' page offline. By modifying certain field values, the attacker may corrupt the MaxWebPortal contents. MaxWebPortal has also been reported prone to insecure session cookie vulnerability. Reportedly if an attacker can retrieve a session cookie for a legitimate MaxWebPortal user, the attacker may hijack the account. MaxWebPortal has been reported prone to a database disclosure vulnerability. MaxWebPortal does not sufficiently secure the database file. It is possible for remote attackers to request the database file and gain access to sensitive information. MaxWebPortal 'password.asp' has been reported prone to a password-reset vulnerability. It has been reported that by requesting a forgotten password, an attacker may save the 'password reset' page offline. By modifying the member id in the script the attacker may reset arbitrary account passwords.
A vulnerability has been reported for zblast, an svgalib-based game. The problem occurs when copying data from a user-supplied environment variable into a static memory buffer. By storing excessive data within the variable, it may be possible for an attacker to corrupt process memory, ultimately resulting in the execution of arbitrary code.
Synkron.web is prone to HTML injection attacks. The vulnerability exists in the search script and is a result of insufficient sanitization of malicious HTML code from user-supplied input. HTML and script code may be echoed back when an existing user is views a cached search page. Exploitation could allow for attacks that steal cookie-based authentication credentials.
ImageFolio 'admin.cgi' has been reported prone to a directory traversal vulnerability. By supplying directory traversal sequences, as a URI parameter, to the 'admin.cgi' script an attacker may break out of the web root directory. Successful exploitation may expose sensitive information to remote attackers. This information could be used to aid in further attacks against the affected system.
A vulnerability has been discovered in the HP-UX 11 ftpd daemon. The problem can be triggered using the FTP REST command. By specifying a specially calculated numeric argument to the command, it is possible to disclose the contents of that numeric location in process memory. This issue may be exploited to disclose the contents of sensitive files, such as /etc/passwd.
It has been reported that the Sun Java Runtime Environment does not properly protect trusted java applets. Because of this, it may be possible for an attacker to use a malicious applet to gain access to sensitive information.
A vulnerability has been reported for Mailtraq that may result in the disclosure of path information. The vulnerability exists due to insufficient sanitization of HTTP requests. Specifically, a request for non-existent resources will result in an error message being returned that includes path information, which could allow a remote attacker to gain knowledge of the system's directory structure.
Services By CQR