[CLOSE] OSVDB ID : 12506 - Disclosed: 2004-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 8378 - Disclosed: 2003-06-28

Description:

WackoWiki contains a flaw that may lead to an unauthorized information disclosure. Nio further details have been provided.

[CLOSE] OSVDB ID : 8376 - Disclosed: 2003-06-28

Description:

WackoWiki contains multiple flaws that allows remote cross site scripting attacks. No further details have been provided.

[CLOSE] OSVDB ID : 14750 - Disclosed: 1985-01-01

Description:

By default, Waffle BBS installs with a default password. The root account has a blank password which is publicly known and documented. This allows attackers to trivially access the program or system.

[CLOSE] OSVDB ID : 14740 - Disclosed: 1991-03-08

Description:

The external LIST command used in many Waffle BBS installations may allow a user to display the content of any file on the system. The issue is that the LIST command would allow a user to supply any file on the system, including the /waffle/admin/password file. Because the command also ignores the ^Z character, it would display the entire file including the system password.

[CLOSE] OSVDB ID : 14749 - Disclosed: 1991-03-08

Description:

Waffle BBS contains a flaw that may allow a user to bypass file download ratio restrictions. The issue is due to the BBS software not properly filtering file requests passed to the ZMODEM program. By specifying a wildcard for file downloads, a user can download any file without it counting against their ratio.

[CLOSE] OSVDB ID : 78519 - Disclosed: 2012-01-20

Description:

WAGO I/O System 750 / 758 contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the changing of an administrator's password. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 78781 - Disclosed: 2012-01-20

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 78780 - Disclosed: 2012-01-20

Description:

By default, WAGO I/O System 750 installs with multiple default passwords. The admin account has a password of wago, the user account a password of user, and the guest account a password of guest, which are publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.

[CLOSE] OSVDB ID : 78782 - Disclosed: 2012-01-20

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51640 - Disclosed: 2009-01-16

Description:

Walking Club contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.aspx script not properly sanitizing user-supplied input to the 'username' and 'password' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 20885 - Disclosed: 2005-11-14

Description:

(Description Provided by CVE) : ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to access arbitrary local files via the querystring.

[CLOSE] OSVDB ID : 20884 - Disclosed: 2005-11-14

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20883 - Disclosed: 2005-11-14

Description:

Walla TeleSite contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the ts.exe (also know as ts.cgi) script not properly sanitizing user-supplied input to the 'sug' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 20882 - Disclosed: 2005-11-14

Description:

Walla TeleSite contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'sug' parameter upon submission to the 'ts.exe' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 20881 - Disclosed: 2005-11-14

Description:

(Description Provided by CVE) : ts.exe in Walla TeleSite 3.0 and earlier allows remote attackers to access privileged information by entering the article number in tsurl parameter.

[CLOSE] OSVDB ID : 40368 - Disclosed: 2007-12-22

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter to category.php or (2) the groupid parameter to editadgroup.php.

[CLOSE] OSVDB ID : 40369 - Disclosed: 2007-12-22

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter to category.php or (2) the groupid parameter to editadgroup.php.

[CLOSE] OSVDB ID : 35986 - Disclosed: 2006-11-24

Description:

Wallpaper Website contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'dlwallpaper.php' script not properly sanitizing user-supplied input to the 'wallpaperid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 35985 - Disclosed: 2006-11-24

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Wallpaper Website (Wallpaper Complete Website) 1.0.09 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login or (2) password parameter to (a) process.php, or the (3) wallpaperid parameter to (b) dlwallpaper.php.

[CLOSE] OSVDB ID : 30680 - Disclosed: 2006-11-23

Description:

(Description Provided by CVE) : SQL injection vulnerability in wallpaper.php in Wallpaper Website (Wallpaper Complete Website) 1.0.09 allows remote attackers to execute arbitrary SQL commands via the wallpaperid parameter.

[CLOSE] OSVDB ID : 73217 - Disclosed: 2011-05-26

Description:

(Description Provided by CVE) : WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.

[CLOSE] OSVDB ID : 73216 - Disclosed: 2011-06-02

Description:

(Description Provided by CVE) : Unspecified vulnerability in WalRack 1.x before 1.1.8 and 2.x before 2.0.6 has unknown impact and attack vectors, possibly related to file deletion and an encoded URL, a different vulnerability than CVE-2011-1329.

[CLOSE] OSVDB ID : 37187 - Disclosed: 2007-06-08

Description:

(Description Provided by CVE) : Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors.

[CLOSE] OSVDB ID : 62481 - Disclosed: 2010-02-22

Description:

WampServer contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'lang' parameter upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 21867 - Disclosed: 2005-12-22

Description:

Wandsoft e-Search contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'keywords' variable. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 76230 - Disclosed: 2010-09-23

Description:

WAnewsletter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 38812 - Disclosed: 2007-05-28

Description:

WAnewsletter contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to 'newsletter.php' not properly sanitizing user input supplied to the 'waroot' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 48840 - Disclosed: 2008-04-18

Description:

(Description Provided by CVE) : Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."

[CLOSE] OSVDB ID : 14392 - Disclosed: 2005-02-28

Description:

Unknown / Incomplete