Security advisories
Portcullis security advisories are published for significant security issues that require an upgrade, fix, or other action.
In all security publications, we disclose the minimum amount of information required for an end-user to assess the
impact of a vulnerability and any potential steps needed to protect their environment.
2012
12-004 - Qt System V Shared Memory Segments Created With Insecure Permissions
2010
10-001 - mod_rsawebagent Is Vulnerable To Directory Traversal
2009
09-011 - Multiple Vulnerabilities in the Accellion Secure File Transfer Web Application
09-010 - Accellion Secure File Transfer Web Application Is Vulnerable To Directory Traversal
09-009 - Accellion Secure File Transfer Command Line Interface Is Vulnerable To Privilege Escalation
09-008 - Insufficient Input Validation By IO Slaves
09-004 - KMail Attachment Mime Type Spoofing Enables Javascript Injection
09-003 - Form Spoofing In Konqueror Enables Kwallet Stored Credential Theft
09-002 - Ark Default View Allows JavaScript Injection
2008
08-010 - Microsoft Windows Active Directory LDAP Server
08-009 - Checkpoint VPN-1 PAT information disclosure
08-008 - ScrewTurn Wiki Permanent Cross-site Scripting
08-007 - Affinium Campaign denial of service
08-006 - Affinium Campaign Directory Traversal
08-005 - Affinium Campaign reflected JavaScript injection
08-004 - Affinium Campaign second order JavaScript injection
08-003 - Affinium Campaign JavaScript injection
08-002 - Affinium Campaign Directory Traversal
08-001 - Affinium Campaign JavaScript injection
2007
07-016 – Multiple SQL Injections In Cisco Call Manager User And Admin Interface
07-014 – SQL Injections Vulnerabilities In GForge.
07-013 – Remote Code Execution In GreenSQL Logging Facility
07-012 – Fatwire CMS is vulnerable to XSS in multiple locations
07-011 – Magnolia Content Management System Unauthorized File Upload – Update
07-011 – Magnolia Content Management System Unauthorized File Upload – Original
07-010 - Re-introduction of Cross-site Scripting/Cookie Theft Vulnerability>
07-009 – MySQL Remote Denial of Service
07-008 – Denial of service due to format string vulnerability in DCC File Transfer
07-007 – Denial of service due to Heap Smash while parsing CTCP requests
07-006 – Search Parameters are Vulnerable to SQL Injection
07-005 – Parameters Are Vulnerable To A Reflected JavaScript Injection
07-004 – Conversation logs are vulnerable to a reflected Javascript injection
07-003 – Malformed Requests Result in Directory Path Disclosure
07-001 – ASP.Net Request Validation Bypass
2006
06-064 - Belkin Router G Plus Router (F5D7231-4) Administration Web Interface
06-063 - Centericq is vulnerable to multiple buffer overflows
06-062 - SurgeFTP is vulnerable to Cross-site Scripting(XSS)
06-061 - SurgeFTP mirror mechanism allows the Denial of Service
06-060 - SurgeMail is prone to a format string vulnerability
06-059 - ImgSvr is vulnerable to a directory traversal
06-058 - ImgSvr is vulnerable to a stack overflow
06-057 - E-Visit Analyst – multiple CGI scripts allow SQL injection
06-046 - Visionsoft Audit – VSAOD server discloses its version
06-045 - Visionsoft Audit – VSAOD server allows unauthenticated remote uninstalls
06-044 - Visionsoft Audit – VSAOD server allows remote execution via replay attacks
06-043 - Visionsoft Audit – VSAOD server discloses the log path
06-041 - Visionsoft Audit – VSAOD server allows unauthenticated ini file overwrites
06-039 - Visionsoft Audit – VSAOD server allows unauthenticated arbitrary file overwrites
06-038 - Username enumeration is possible via the password reset mechanism
06-036 - A potential phishing attack via the comments mechanism
06-035 - The create entry mechanism is vulnerable to JavaScript injection
06-033 - The username and password hash for the administration interface is stored within a cookie
06-018 - Informix Username Buffer Overflow Vulnerability
06-011 - Fujitsu Webserver Source Code Disclosure Vulnerability
06-010 - Fujitsu Webserver Directory Traversal Vulnerability
06-005 - P-Synch Username Enumeration Vulnerability
06-004 - P-Synch Multiple Request Methods Supported Vulnerability
06-003 - P-Synch Reduced Authentication Complexity Vulnerability
06-002 - P-Synch Password Management Vulnerability
06-001 - NetIQ Endpoint Heap Overflow
2005
05-014 - HP Openview Remote Command Execution Vulnerability
05-013 - Asterisk Stack Overflow
05-012 - Ebay Session Riding Vulnerability
05-010 - MediaPartner Directory Traversal Vulnerability
05-009 - Webseries Arbitary Report Execution Vulnerability
05-008 - Webseries Poor Password Change Vulnerability
05-007 - Webseries Password Policy Implemented At Client rather than Server
05-006 - Webseries Directory & File Enumeration Vulnerability
05-005 - Webseries Internal Path Disclosure Vulnerability
05-004 - MediaPartner Source Code Disclosure Vulnerability
05-003 - MediaPartner Password Update Process Vulnerability
05-002 - Spectrum Cash Receipting System Weak Password Protection Vulnerability
05-001 - Webseries Lack of Backend Authorisation Checking Vulnerability