Xerver 4.31/4.32 - HTTP Response Splitting

Xerver 4.31, 4.32 HTTP Response Splitting Discovered: 04-10-08 By: SecureState R&D Team - sasquatch Vendor Notified: 04-11-08 Vendor Response: 04-13-08 New version also vulnerable: 10-07-09 Tested Win32 v4.32 Vendor Notified: 10-07-09 Vendor Response: NONE Published: 11-18-09 Proof of Concept:...

Xerver 4.314.32 - HTTP Response Splitting

Xerver 4.314.32 - HTTP Response Splitting Xerver 4.31, 4.32 HTTP Response Splitting Discovered: 04-10-08 By: SecureState R&D Team - sasquatch Vendor Notified: 04-11-08 Vendor Response: 04-13-08 New version also vulnerable: 10-07-09 Tested Win32 v4.32 Vendor Notified: 10-07-09 Vendor Response: NON...

Unfixed XSS vulnerability at www.diesel-ebooks.com

Security researcher Cody R., has submitted on 10/06/2009 a cross-site-scripting XSS vulnerability affecting www.diesel-ebooks.com, which at the time of submission ranked 26277 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/07/2009. It is...

CVE-2009-2521: Uncontrolled Resource Consumption

Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services IIS 5.0 through 7.0 allows remote authenticated users to cause a denial of service daemon crash via a list ls -R command containing a wildcard that references a subdirectory, followed by a .. dot dot, ak...

CVE-2009-3061

SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3061

SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3061

The CVE-2009-3061 entry concerns a SQL injection in lesson.php of Alqatari Q R Script 1.0, exploitable via the id parameter to execute arbitrary SQL commands. Affected component: lesson.php in Alqatari Q R Script 1.0; root cause is improper input handling allowing SQL command injection. Public re...

CVE-2009-3061: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

Spiceworks 3.6 Accept Parameter Overflow Crash Exploit

Exploit for unknown platform in category dos / poc ====================================================== Spiceworks 3.6 Accept Parameter Overflow Crash Exploit ====================================================== !/usr/bin/python Spiceworks 3.6 Accept Parameter Overflow Remote Crash P.O.C...

SpiceWorks 3.6 - 'Accept' Overflow Crash

!/usr/bin/python Spiceworks 3.6 Accept Parameter Overflow Remote Crash P.O.C. Written by: SecureState R&D Author: David Kennedy ReL1K Tested on Windows 2003 SP2 R2 Vendor Notified on: 05/11/2009 Vendor Fix: Fixed in version 4.0 esi 000334E0 ASCII "AAAAAAAAAAAAAAAAAA" edi 000334E0 ASCII...

Payment Processor Script Blind SQL Injection

PaymentProcessorScript.net R-Sql/B-Sql Multiple Vulns. ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 04.01.09 Home: z0rlu.blogspot.com / www.experl.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : EN ONEMLi N0T: demolarI...

Payment Processor Script (shop.htm cid) SQL Injection Vulnerability

No description provided by source. PaymentProcessorScript.net R-Sql/B-Sql Multiple Vulns. ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 04.01.09 Home: z0rlu.blogspot.com / www.experl.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIM...

CVE-2009-2359: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via 1 the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or 2 the command-line client, as demonstrated by a certain trcli -r command...

CVE-2009-1827: Undefined Security Weakness

The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service application hang via a large value in the r aka Radius attribute of a circle element, related to an "unclamped loop."...

Soulseek 157 NS Remote Buffer Overflow Exploit (SEH)

No description provided by source. !/usr/bin/python x Bug :Soulseek 157 NS Remote Seh Overwrite Exploit x Credits & poc from : http://www.milw0rm.com/exploits/8777 x Tested on : Windows Xp sp3, Soulseek 157 NS 12d x The exploit attacks the user :"test4321" import struct import sys, socket from ti...

Mandriva Linux Security Advisory : R-base (MDVSA-2008:198)

A symlink vulnerability was found in the javareconf script in R that allows local users to overwrite arbitrary files CVE-2008-3931. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CVE-2008-6683: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject arbitrary web script or HTML via the r parameter...

Mandriva Update for R-base MDVSA-2008:198 (R-base)

Check for the Version of R-base OpenVAS Vulnerability Test Mandriva Update for R-base MDVSA-2008:198 R-base Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Mandriva Update for R-base MDVSA-2008:198 (R-base)

Check for the Version of R-base OpenVAS Vulnerability Test Mandriva Update for R-base MDVSA-2008:198 R-base Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...