When Small Mistakes Can Cause Big Problems	September 18, 2021
GulfTech Security Research was able to find in the past few weeks, cross site scripting issues that existed on eBay, Amazon, Half.com, HBO, CareerBuilder, AOL, CNN, MTV, and many others. The cross site scripting issues on these websites could allow an attacker to take control of arbitrary accounts, or steal sensitive info. Websites such as eBay, Amazon, and Half.com (for example) have fairly good Security when it comes to protecting their user’s accounts, but even they are vulnerable to data theft via these vulnerabilities. For example, it may be somewhat useless to steal a victim’s cookie, or try and render malicious code, or force command execution on a website with tight account security. So instead of relying on some great technological advantage an attacker could simply attempt to take advantage of the human element and have the victim simply give the attacker their account information. This can be done by using the cross site scripting vulnerabilities to temporarily deface a website. So, instead of rendering malicious code, or trying to steal a user’s cookie, the attacker can link to an offsite JavaScript, and have it render a login form using the vulnerable website’s own HTML and Style Sheet so that it looks nearly identical to the legitimate login form. Of course when a victim logs in to this form it actually just steals their login credentials. The attacker could also use the same methods of temporarily defacing the website to show someone a fictitious news story on a major news website.
Read This Article	Article Read 2111 Times

RhinoSoft DNS4ME HTTP Server Vulnerabilities	September 16, 2021
DNS4Me is the dynamic DNS service that you need to start hosting your own Internet services. When you have a dynamic IP address, you need something to associate a static domain name with it to make it easier for visitors to access the services you provide. With DNS4Me, you can take control of your Web site by running your own HTTP server. Without a hosting company, you've eliminated the cost of hosting as well as a layer of contact between you and your Web site. This gives you unparalleled control overits configuration, content, and delivery. But the benefits of dynamic DNS aren't just for HTTP servers. Any service that can make use of a domain name can benefit from DNS4Me. This includes FTP servers, e-mail servers, daemons for today's popular computer games, NetMeeting… With the reliability and excellent support you've come to expect of RhinoSoft.com backing up DNS4Me, you'll get a powerful, no hassle dynamic DNS solution. The RhinoSoft DNS4ME HTTP server is prone to multiple vulnerabilities, and users are encouraged to upgrade as soon as possible.
Read This Article	Article Read 679 Times

Multiple Vulnerabilities In phpWebsite	August 31, 2021
phpWebSite provides a complete web site content management solution. All client output is valid XHTML 1.0 and meets the W3C's Web Accessibility Initiative requirements. Currently features: announcement posting, form generator, user management with granulated administration, calendar, poll, faq, photoalbum, bulletin board, rss feeds, user customizable theme support and more. It is one of the most popular content managment systems in the world. However, it is vulnerabile to a number of attacks, some of which allow an attacker to completely take control of a vulnerable phpWebsite installation. Other vulnerabilties in phpWebsite include script injection, SQL injection, forced command execution, and cross site scripting. A security update is available and all phpWebsite users should upgrade their installation as soon as possible.
Read This Article	Article Read 1915 Times

Multiple Vulnerabilities In Xedus Webserver	August 30, 2021
Xedus is a Peer-to-Peer web server and provides you with the ability to share files, music, and any other media, as well as create robust and dynamic web sites, which can feature database access, file system access, with full .net support. Powered by a built in server-side, Microsoft C#, scripting language; Xedus boasts the ability to create sites that can rival web applications built on any other enterprise servers like Apache, IIS, Iplanet… With Xedus, you will never need to pay to host your sites again. Using the peer-to-peer mode, other members of LIVE can access you site by keyword using Internet Explorer even if you do not have a static IP address! Xedus is prone to a number of vulnerabilities, which include Denial Of Service, Cross Site Scripting, and Directory Traversal attacks. These vulnerabilities can allow an attacker to retrieve arbitrary files from the host machine, as well as deny legitimate users access to the webserver.
Read This Article	Article Read 513 Times

Keene Digital Media Server Directory Traversal	August 25, 2021
Keene Digital Media Server is an easy and affordable way to share all things digital with friends, family, and customers over your broadband connection. DMS turns your computer into a highly secure Web server that automatically converts your files and folders into Web pages, thumbnails, and media shows with no Web programming required. Integrated user and file access security management provide the ultimate control over your content. Keene Digital Media Server allows an attacker to traverse out of the web directory, and retrieve arbitrary files.
Read This Article	Article Read 469 Times

Easy File Sharing Webserver v1.25 Vulnerabilities	August 24, 2021
Easy File Sharing Web Server is a file sharing software that allows visitors to upload/download files easily through a Web Browser (IE,Netscape,Opera etc.). It can help you share files with your friends and colleagues. They can download files from your computer or upload files from theirs. They will not be required to install this software or any other software because an internet browser is enough. Easy File Sharing Web Server also provides a Bulletin Board System (Forum). The Easy File Sharing Web Server is vulnerable to both Denial Of Service attacks, and unauthorized access to the virtual folders used by the webserver. These vulnerabilities could allow an attacker to crash/DoS the server, or gain read access to arbitrary folders on the server.
Read This Article	Article Read 943 Times

Possible Security Issues In LiveWorld Products	August 23, 2021
LiveWorld provides collaborative services for online meetings, customer care, and loyalty marketing. Supporting communication between a company and its customers, employees, or partners and among those people themselves - our services help corporations cut costs, increase revenue, and solidify relationships with groups critical to their success. The affected products are beleived to be prone to Cross Site Scripting issues which allow a malicious user to steal sensitive data, temporarily deface a page, or render any malicious script in the context of the victim's browser. The software believed to be vulnerable is LiveForum, LiveQ&A;, and LiveFocusGroups. LiveWorld products are used on major websites such as HBO, eBay, and others.
Read This Article	Article Read 601 Times

BadBlue Web Server Denial of Service Vulnerability	August 20, 2021
BadBlue lets you run a no-hassle Web site on your own PC for free, including a domain name you can choose. Within seconds, you can transform your PC into a friendly, file-sharing Web server with all the power of a real server on the Internet. Remote users can search for files, explore your shared folders, and run full-blown applications created in HTML, PHP, Perl, and so on. This HTTP server is vulnerable to a Denial of Service attack. This attack can take place when a malicious user makes a certain number of connections to the server. Included is proof of concept code.
Read This Article	Article Read 359 Times

SubScan 1.3 DNS Enumeration Utility Released	August 18, 2021
After a way too long awaited release SubScan 1.3 is here. It is a beta copy, but works. I call it a beta because right now it is only for the Windows OS. I plan changing this in the very near future, but until then the source is available if you want to make it better. Some of the new features in SubScan 1.3 are netblock scans, deep scan, and a wildcard DNS option that helps ignore duplicate records. The deep scan is my favorite feature of the new release, and allows for the enumaration of up to one hundred times more DNS records than in SubScan 1.2. If you have any questions about this release you can get them answered on our forums. Please read the README file before asking any questions though
Read This Article	Article Read 747 Times

Invision Power Board IP Spoofing Vulnerability	June 16, 2022
Invision Power Board (IPB) is a professional forum system that has been built from the ground up with speed and security in mind, taking advantage of object oriented code, highly-optimized SQL queries, and the fast PHP engine. A comprehensive administration control panel is included to help you keep your board running smoothly. Moderators will also enjoy the full range of options available to them via built-in tools and moderators control panel. Members will appreciate the ability to subscribe to topics, send private messages, and perform a host of other options through the user control panel. It is used by millions of people over the world. There lies a vulnerability in all version of Invision Power Board that allow a user to spoof his/her IP address by creating a bogus X_FORWARDED_FOR HTTP Header entry. This condition can also be caused by a user unknowingly if they use a proxy to access the internet. For example, private LAN based IP's will be logged which are impossible to trace.
Read This Article	Article Read 691 Times

Multiple Vulnerabilities In PHPX 3.26 And Earlier	May 04, 2022
PHPX is a constantly evolving and changing Content Management System (CMS). PHPX is highly customizable and high powered all in one system. PHPX provides content management combined with the power of a portal by including in the core package modules such as FAQ, polls, and forums. PHPX uses dynamic-template-design, what this means is that you have the power to control what your site will look like. Themes are included, but not required. You can create the page however you want, and PHPX will just insert code where you want it. No more 3 columns if you don’t want it! Written in the powerful server language, PHP, and utilizing the amazingly fast and secure database MySQL, PHPX is a great solution for all size website communities, at the best price possible…free! Vulnerabilities are present in version(s) 3.2.6 and earlier and present themselves in the form of cross site scripting, path disclosure, and arbitrary command execution. Users are advised to upgrade immeadiately.
Read This Article	Article Read 308 Times

Multiple Vulnerabilities In OpenBB	April 24, 2022
OpenBB is a fast, lightweight, powerful bulletin board written in PHP/MySQL. Main features include: full customization via styles templates, instant messaging, private messaging, categories, member ranks, poll based threads, moderation, BB codes, thread notifications, Avatars, member lists, private forums and more. OpenBB is prone to several security issues such as SQL Injection, XSS, arbitrary command execution and more.
Read This Article	Article Read 619 Times

phpBugTracker Multiple Vulnerabilities	April 14, 2022
phpBugTracker is meant to be a replacement for Bugzilla. Simplicity in use and installation, Use templates to achieve presentation independence, Use a database abstraction layer to achieve database independence. phpBugTracker is a portable and powerful web-based bug tracking system. It is vulnerable to several issues including XSS, SQL injection and Script Injection. These issues can be used to expose and alter database information.
Read This Article	Article Read 332 Times

Multiple Vulnerabilities in TikiWiki CMS Groupware	April 11, 2022
Tiki CMS/Groupware (aka TikiWiki) is a powerful open-source Content Management System (CMS) and Groupware that can be used to create all sorts of Web applications, Sites, Portals, Intranets and Extranets. TikiWiki also works great as a Web-based collaboration tool. TikiWiki is a multi-purpose package with a lot of native options and sections that you can enable/disable as you need them. It is designed to be international, clean and extensible. TikiWiki incorporates all the features present in several excellent wiki systems available today plus a lot of new features and options, allowing your wiki application to be whatever you want it to be--from a simple wiki to a complex site for a whole user community with many intermediate steps. You can use TikiWiki as a forums site, a chatroom, for poll taking, and much more! There lies a number of vulnerabilities in TikiWiki though. These vulnerabilities include SQL Injection, Directory Traversal, Information Disclosre, Arbitrary File Upload, XSS, Script Injection and more.
Read This Article	Article Read 380 Times

PhotoPost PHP Pro Multiple Vulnerabilities	March 28, 2022
PhotoPost PHP Pro is a photo gallery script that allows users to share, upload and manage their photos. PhotoPost also integrates seamlessly into a number of large name forum systems such as Invision Power Board, phpBB, vBulletin, and many more. It is prone to a number of security issues which allow for attack on not only the PhotoPost installation, but also the forum it is integrated into. These vulnerabilities include SQL Injection, XSS, Denial Of Service and Script Injection. Most of the issues seem to be resolved in 4.7
Read This Article	Article Read 386 Times

Invision Gallery SQL Injection Vulnerabilities	March 22, 2022
Invision Gallery is a fully featured, powerful gallery system that is easy and fun to use! It plugs right into your existing Invision Power Board to create a seamless browsing experience for the users of your forum. Unfortunately Invision Gallery comes up very short in regards to user supplied input validation. Because of this an attacker can influence queries, and even use these issues to launch an attack against the IPB instalattion on which the gallery resides.
Read This Article	Article Read 468 Times

Invision Power Top Site List SQL Injection Vulnerability	March 21, 2022
Invision Power Top Site List is a flexible site ranking script written in PHP, the popular programming choice for web developers. Featuring an impressive feature set with a user-friendly interface your community will feel at home using the system. It is vulnerable to attack though through a fairly serious SQL Injection issue which may allow an attacker to query arbitrary information such as hashed admin credentials and more.
Read This Article	Article Read 319 Times

phpBB 2.0.7a And Earlier Security Issues	March 20, 2022
phpBB 2.0.7 and earlier have a number of security issues. One of these issues is SQL Injection and Cross Site Scripting in the admin panel. This is an issue that would take either admin access or a bit of social engineering for an attacker to use. But there is a far more serious problem in phpBB and that problem is lack of session authentication in certain parts of phpBB. This could allow for a malicious user to have an admin unknowingly execute undo-able actions in both the admin panel and the forum itself. This issue also affects users. Read this for more details.
Read This Article	Article Read 752 Times

Mambo Open Source Multiple Vulnerabilities	March 16, 2022
Mambo Open Source is the finest open source Web Content Management System available today. Mambo Open Source makes communicating via the Web easy. Have you always wanted to have your own site but never understood how? Well Mambo Open Source is just the ticket! With Mambo Open Source there is no need for HTML, XML or DHTML skills, just enter your content, add a picture and then through the easy to use administrator web-interface ...click Publish! Simple ... Quick ... And easy! With the in-built editor Mambo Open Source allows you to design and create your content without the need for HTML code. Maintaining a website has never been easier. Mambo Open Source is vulnerable to several attacks including cross site scripting as well as SQL Injection vulnerabilities.
Read This Article	Article Read 413 Times

Multiple JelSoft vBulletin XSS Vulnerabilities	March 15, 2022
JelSoft vBulletin is a powerful, scalable and fully customisable forums package for your web site. Based on the PHP language, and backed with a MySQL back-end database. It is one of the most popular forum systems in the world. It is also prone to several XSS (Cross Site Scripting) issues which may allow an attacker to disclose sensetive user information, and run code in the context of a victims web browser. Check the JelSoft website for any updates regarding this issue.
Read This Article	Article Read 489 Times