|
 |
| SecurityReason | ||
| WLB | ||
| RSS | ||
| Corporate | ||
| Services | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityAlert | ||||
 SecurityAlert : 723 CVE : CVE-2006-1813 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Exploit Given : Yes Credit : arko dhar gmail com Published : 17.04.2006
Advisory Text : Summary =============================================== phpWebFTP enables connections to FTP servers, even behind a firewall not allowing traffic. phpWebFTP bypasses the firewall by making a FTP connection from your webserver to the FTP server and transfering the files to your webclient over the http protocol =========================================== Issue : Well I have found that most of the sites that use phpwebftp v3.2 > less have a problem. The user login script is a javascript file called script.js. This file validates the user input in the logon box. But to my surprise this file is directly accessed by web browser . The disclosure of the source code can help an attacker to trigger code injections . Exploit : http://www.anysite.com/PhpWebFtp/include/script.js Further a directory traversal is possible via malicious arguments passed on the web browser using POST Method relative to the path of phpWebftp ie. http://www.anysite.com/PhpWebFtp/index.php? . 'server=1&port=21&goPassive=on&user=1&password=1&language=../../../../.. /../../../etc/passwd%00' Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Microsoft VISTA TCP/IP stack buffer overflow
Microsoft Device IO Control wrapped by the iphlpapi.dll API shipping with Windows Vista 32 bit and 64 bit contains a possibly exploitable, buffer overflow corrupting kernel memory. |
||
| Apache |  |
|
» Apache Tomcat <= |
||
| PHP | |
|
» PHP |
||
- 2008-11-27| Copyright © SecurityReason. All Rights Reserved. |