Vulnerabilidades

Cross-site scripting vulnerability in signgbook.php for BG GuestBook 1.0 allows remote attackers to execute arbitrary Javascript via encoded tags such as <, >, and & in fields such as (1) name, (2) email, (3) AIM screen name, (4) website, (5) location, or (6) message.

Vulnerabilidad de secuencia de comandos en sitios cruzados en guestbook.pl para el Philip Chinery's Guestbook 1.1 permite que atacantes remotos ejecuten Javascript o HTML por medio de campos como el nombre, la dirección de e-mail o la página de inicio.

Vulnerabilidad de secuencia de comandos en sitios cruzados en MyGuestbook 1.0 permite que atacantes remotos ejecuten código script arbitrario o inyecten HTML por medio de campos como "nombre de usuario" o "comentarios".

Cross-site scripting vulnerability in Dynamic Guestbook 3.0 allows remote attackers to execute code in clients who access guestbook pages via the parameters (1) name, (2) mail, or (3) kommentar.

Dynamic Guestbook 3.0 allows remote attackers to execute arbitrary code via shell metacharacters in the gbdaten parameter.

Buffer overflow in Sun AnswerBook2 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.

La hoja de estilo por defecto de DocBook en RedHat Linux 6.2 a 7.2 se instala con una opción insegura activada, lo que podría permitir a usuarios sobreescribir ficheros fuera del directorio actual desde un documento no de confianza, usando una ruta larga como elemento identificador.

Vulnerability in (1) Book of guests and (2) Post it! allows remote attackers to execute arbitrary code via shell metacharacters in the email parameter.

book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter.

Bill Kendrick web site guestbook (GBook) allows remote attackers to execute arbitrary commands via shell metacharacters in the _MAILTO form variable.

The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, which allows remote attackers to add user accounts to the interface by directly calling the admin CGI script.

The administration interface for the dwhttpd web server in Solaris AnswerBook2 allows interface users to remotely execute commands via shell metacharacters.

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

Vulnerability in the Wguest CGI program.

The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a remote attacker to read arbitrary files using the "template" parameter.

Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data.

Format string vulnerability in AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via encoded % characters in an HTTP request, which is improperly logged.

Remote execution of arbitrary commands through Guestbook CGI program.