Tried, Tested and Proven

Portcullis security advisories are published for significant security issues that require an upgrade, fix, or other action.

In all security publications, we disclose the minimum amount of information required for an end-user to assess the
impact of a vulnerability and any potential steps needed to protect their environment.

Read our Co-ordinated Disclosure Policy.

12-004 – Qt System V Shared Memory Segments Created With Insecure Permissions

10-001 – mod_rsawebagent Is Vulnerable To Directory Traversal

09-011 – Multiple Vulnerabilities in the Accellion Secure File Transfer Web Application

09-010 – Accellion Secure File Transfer Web Application Is Vulnerable To Directory Traversal

09-009 – Accellion Secure File Transfer Command Line Interface Is Vulnerable To Privilege Escalation

09-008 – Insufficient Input Validation By IO Slaves

09-004 – KMail Attachment Mime Type Spoofing Enables Javascript Injection

09-003 – Form Spoofing In Konqueror Enables Kwallet Stored Credential Theft

09-002 – Ark Default View Allows JavaScript Injection

08-010 – Microsoft Windows Active Directory LDAP Server

08-009 – Checkpoint VPN-1 PAT information disclosure

08-008 – ScrewTurn Wiki Permanent Cross-site Scripting

08-007 – Affinium Campaign denial of service

08-006 – Affinium Campaign Directory Traversal

08-005 – Affinium Campaign reflected JavaScript injection

08-004 – Affinium Campaign second order JavaScript injection

08-003 – Affinium Campaign JavaScript injection

08-002 – Affinium Campaign Directory Traversal

08-001 – Affinium Campaign JavaScript injection

07-016 – Multiple SQL Injections In Cisco Call Manager User And Admin Interface

07-014 – SQL Injections Vulnerabilities In GForge.

07-013 – Remote Code Execution In GreenSQL Logging Facility

07-012 – Fatwire CMS is vulnerable to XSS in multiple locations

07-011 – Magnolia Content Management System Unauthorized File Upload – Update

07-011 – Magnolia Content Management System Unauthorized File Upload – Original

07-010 – Re-introduction of Cross-site Scripting/Cookie Theft Vulnerability>

07-009 – MySQL Remote Denial of Service

07-008 – Denial of service due to format string vulnerability in DCC File Transfer

07-007 – Denial of service due to Heap Smash while parsing CTCP requests

07-006 – Search Parameters are Vulnerable to SQL Injection

07-005 – Parameters Are Vulnerable To A Reflected JavaScript Injection

07-004 – Conversation logs are vulnerable to a reflected Javascript injection

07-003 – Malformed Requests Result in Directory Path Disclosure

07-001 – ASP.Net Request Validation Bypass

06-064 – Belkin Router G Plus Router (F5D7231-4) Administration Web Interface

06-063 – Centericq is vulnerable to multiple buffer overflows

06-062 – SurgeFTP is vulnerable to Cross-site Scripting(XSS)

06-061 – SurgeFTP mirror mechanism allows the Denial of Service

06-060 – SurgeMail is prone to a format string vulnerability

06-059 – ImgSvr is vulnerable to a directory traversal

06-058 – ImgSvr is vulnerable to a stack overflow

06-057 – E-Visit Analyst – multiple CGI scripts allow SQL injection

06-056 – The P-Synch Windows domain password reset web applications style parameter allows JavaScript injection

06-046 – Visionsoft Audit – VSAOD server discloses its version

06-045 – Visionsoft Audit – VSAOD server allows unauthenticated remote uninstalls

06-044 – Visionsoft Audit – VSAOD server allows remote execution via replay attacks

06-043 – Visionsoft Audit – VSAOD server discloses the log path

06-042 – Visionsoft Audit – VSAOD server uses a weak algorithm to obscure passwords on the wire and in configuration files

06-041 – Visionsoft Audit – VSAOD server allows unauthenticated ini file overwrites

06-040 – Visionsoft Audit- VSAOD server has input validation flaws which can result in an authenticated heap overflow

06-039 – Visionsoft Audit – VSAOD server allows unauthenticated arbitrary file overwrites

06-038 – Username enumeration is possible via the password reset mechanism

06-037 – The Upload mechanism potentially allows the upload of arbitrary code for execution as the web server user

06-036 – A potential phishing attack via the comments mechanism

06-035 – The create entry mechanism is vulnerable to JavaScript injection

06-034 – The blog directory path can be set to any arbitrary directory path during the creation of new blogs

06-033 – The username and password hash for the administration interface is stored within a cookie

06-018 – Informix Username Buffer Overflow Vulnerability

06-011 – Fujitsu Webserver Source Code Disclosure Vulnerability

06-010 – Fujitsu Webserver Directory Traversal Vulnerability

06-005 – P-Synch Username Enumeration Vulnerability

06-004 – P-Synch Multiple Request Methods Supported Vulnerability

06-003 – P-Synch Reduced Authentication Complexity Vulnerability

06-002 – P-Synch Password Management Vulnerability

06-001 – NetIQ Endpoint Heap Overflow

05-014 – HP Openview Remote Command Execution Vulnerability

05-013 – Asterisk Stack Overflow

05-012 – Ebay Session Riding Vulnerability

05-011 – ACPI 1.6 BIOS

05-010 – MediaPartner Directory Traversal Vulnerability

05-009 – Webseries Arbitary Report Execution Vulnerability

05-008 – Webseries Poor Password Change Vulnerability

05-007 – Webseries Password Policy Implemented At Client rather than Server

05-006 – Webseries Directory & File Enumeration Vulnerability

05-005 – Webseries Internal Path Disclosure Vulnerability

05-004 – MediaPartner Source Code Disclosure Vulnerability

05-003 – MediaPartner Password Update Process Vulnerability

05-002 – Spectrum Cash Receipting System Weak Password Protection Vulnerability

05-001 – Webseries Lack of Backend Authorisation Checking Vulnerability