5631 matches found
HP System Management Homepage (SMH) 'message.php'跨站脚本漏洞
BUGTRAQ ID:30846 CNCAN ID：CNCAN-2008082702 HP System Management Homepage是一款HP公司发布的系统管理主页。 HP System Management Homepage不正确处理用于显示通用错误消息的输入参数，远程攻击者可以利用漏洞进行跨站脚本攻击，可获得敏感信息。 漏洞影响"message.php"脚本，此页面使用JavaScript属性"location.search"用于建立错误消息，如URL中提供的错误ID不匹配任何合法的代码，通用错误会报告"An unknown error %INVALIDCODE%...
[security bulletin] HPSBUX02356 SSRT080051 rev.1 - HP-UX Running ftpd, Remote Privileged Access
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01525562 Version: 1 HPSBUX02356 SSRT080051 rev.1 - HP-UX Running ftpd, Remote Privileged Access NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release...
CVE-2008-1668
CVE-2008-1668 affects HP-UX ftpd (HP-UX B.11.11) and wu-ftpd-based ftpd included with HP-UX. The issue arises when PAM authentication can succeed even if getpwnam returns NULL, allowing remote attackers to gain privileges by logging in as an LDAP user under certain misconfigurations of nsswitch.c...
CVE-2008-1668: Undefined Security Weakness
ftpd.c in 1 wu-ftpd 2.4.2 and 2 ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by ...
Unfixed XSS vulnerability at www.ag-partsnet.com
Security researcher B, has submitted on 08/11/2008 a cross-site-scripting XSS vulnerability affecting www.ag-partsnet.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/09/2009. It is currently...
Code injection
Unspecified vulnerability in libc on HP HP-UX B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown vectors...
HP-UX System Administration Manager NFS配置安全绕过漏洞
BUGTRAQ ID: 30449 CVE ID：CVE-2008-1662 CNCVE ID：CNCVE-20081662 HP-UX是一款商业性质的操作系统。 HP-UX SAM应用程序可为NFS提供不可期的配置，远程攻击者可以利用漏洞绕过部分安全限制，访问受影响的电脑。 目前没有详细漏洞细节提供。 HP-UX B.11.23 HP-UX B.11.11 可参考如下安全公告获得补丁信息：...
kernel security and bug fix update
2.6.9-67.0.22.0.1.EL - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix entropy flag in bnx2 driver to generate entropy pool John Sobecki orabug 5931647 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - fix percpu api bugon wit...
PHP-Nuke Platinium 7.6.b.5 - Remote Code Execution
Date: 02/07/08 Note I modified a bit phpsploit for this exploit, because PHP Nuke plays with REQUESTURI var ... Requirements registerglobals=On phpreter phpreter is really easy to use: You can change mode using "mode=", with = sql, php or cmd If you want to understand how it work ... read the cod...
Security Vulnerability in xwork, need to update to fixed version
see http://cwiki.apache.org/confluence/display/WW/S2-003 confluence currently using v1.0.3. 1.0.x branch was not yet patched so we cannot upgrade straight away. Don B is working on releasing the fix...
Deterministic Network Enhancer dne2000.sys kernel ring0 SYSTEM exploit
No description provided by source. / dne2000-call.c Copyright c 2008 by [email protected] Deterministic Network Enhancer dne2000.sys local kernel ring0 SYSTEM exploit by mu-b - Sun 06 Jan 2008 - Tested on: dne2000.sys 2.21.7.233 - 3.21.7.17464...
Deterministic Network Enhancer dne2000.sys kernel ring0 SYSTEM exploit
Exploit for unknown platform in category local exploits ====================================================================== Deterministic Network Enhancer dne2000.sys kernel ring0 SYSTEM exploit ====================================================================== / dne2000-call.c Copyright c...
Deterministic Network Enhancer dne2000.sys kernel ring0 SYSTEM exploit
No description provided by source. / dne2000-call.c Copyright c 2008 by [email protected] Deterministic Network Enhancer dne2000.sys local kernel ring0 SYSTEM exploit by mu-b - Sun 06 Jan 2008 - Tested on: dne2000.sys 2.21.7.233 - 3.21.7.17464 bundled with: SafeNET HighAssurance Remote,...
Deterministic Network Enhancer - 'dne2000.sys' Kernel Ring0 SYSTEM
/ dne2000-call.c Copyright c 2008 by Deterministic Network Enhancer dne2000.sys local kernel ring0 SYSTEM exploit by mu-b - Sun 06 Jan 2008 - Tested on: dne2000.sys 2.21.7.233 3.21.7.17464 bundled with: SafeNET HighAssurance Remote, SoftRemote Cisco VPN Client Winproxy Compile: MinGW + -lntdll -...
CVE-2008-1680
CVE-2008-1680 affects PHP-Nuke Platinum 7.6.b.5, where a direct request to maintenance/index.php allows remote attackers to disclose configuration information, including settings such as magic_quotes_gpc. The issue is categorized as information disclosure with a CVSS v2 base score of 5.0 (Network...
Fixed XSS vulnerability at b-int.elites0ft.com
Security researcher mastergamer, has submitted on 25/03/2008 a cross-site-scripting XSS vulnerability affecting b-int.elites0ft.com, which at the time of submission ranked 5582444 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/04/2008. It i...
CVE-2008-1431
RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...
Design/Logic Flaw
RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...
CVE-2008-1431
CVE-2008-1431 affects RaidSonic NAS-4220-B with firmware 2.6.0-n (2007-10-11). The vulnerability stems from storing the partition encryption key in an unencrypted /system/.crypt file, encoded with base64, enabling local users to obtain the key. Impact is limited to local access exposure of the en...
