ZABBIX<= 1.8.1 DBcondition函数SQL注入漏洞

BUGTRAQ ID: 39148 CVE ID: CVE-2010-0686 zabbix是一个CS结构的分布式网络监控系统。 Zabbix API使用了include/db.inc.php中定义的DBcondition函数来执行SQL查询中WHERE子句的条件。该函数没有对用户提供数据提供额外的检查： function DBcondition$fieldname, &$array, $notin=false, $string=false global $DB; $condition = ''; ---cut--- $in = $notin?' NOT IN ':' IN ';...

CVE-2010-0686

WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability."...

CVE-2010-0686

Summary: CVE-2010-0686 concerns VMware WebAccess in VMware VirtualCenter (2.0.2/2.5), VMware Server 2.0, and VMware ESX (3.0.3/3.5). The issue is a URL forwarding vulnerability where the WebAccess proxy functionality does not properly validate/limit inbound requests, allowing an attacker to spoof...

VMSA-2010-0005 VMware products address vulnerabilities in WebAccess

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2010-0005 Synopsis: VMware products address vulnerabilities in WebAccess Issue date: 2010-03-29 Updated on: 2010-03-29 initial releas...

SLES9: Security update for samba

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: samba-winbind samba samba-python libsmbclient libsmbclient-devel samba-client samba-pdb For more information, please visit the referenced security advisories...

CVE-2009-0686

CVE-2009-0686 affects Trend Micro Internet Security Pro (2008/2009) and Internet Pro/Security Pro lines. The IOCTL handler in tmactmon.sys (2.52.0.1002) uses METHOD_NEITHER and does not properly validate IRP buffer data, allowing a local user to gain SYSTEM privileges via a crafted IRP to \Device...

[Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities

---------------------------------------------------------------------- PT-2009-09 Positive Technologies Security Advisory Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities ---------------------------------------------------------------------- --- Affected...

CVE-2009-0686

creationtimestamp| type| source ---|---|--- 2009-03-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8322...

Gentoo Security Advisory GLSA 200407-21 (Samba)

The remote host is missing updates announced in advisory GLSA 200407-21. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

FreeBSD Ports: samba

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: pam_smb

The remote host is missing an update to the system as announced in the referenced advisory. VID 2bcd2d24-24ca-11d8-82e5-0020ed76ef5a OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

CVE-2008-0686

CVE-2008-0686 affects Joomla! via the NeoReferences (com_neoreferences) component versions 1.3.1 and 1.3.3. The root cause is a SQL injection in index.php triggered by the catid parameter, allowing remote attackers to execute arbitrary SQL commands. The vulnerability exposes a partial confidentia...

CVE-2007-0686

The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 w29n51.sys allows remote attackers to cause a denial of service system crash via crafted disassociation packets, which triggers memory corruption of "internal kernel structures," a different vulnerability than CVE-2006-6651. NOTE: this issu...

CVE-2007-0686

The CVE-2007-0686 entry concerns the Intel 2200BG wireless driver (W29N51.SYS) version 9.0.3.9. It describes a vulnerability where remote attackers can trigger memory corruption in internal kernel structures by sending crafted disassociation packets, causing a denial of service (system crash). Th...

CVE-2006-0686

adduser.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access...

CVE-2006-0686

CVE-2006-0686 concerns VHCS (Virtual Hosting Control System) versions 2.4.7.1 and earlier. The vulnerability lies in add_user.php, which does not check privileges when creating a new administrative user, enabling a remote attacker to gain unauthorized access. Documents confirm the affected produc...

CVE-2005-0686

Integer overflow in mlterm 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, allows remote attackers to execute arbitrary code via a large image file that is used as a background...

CVE-2005-0686

Integer overflow in mlterm 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, allows remote attackers to execute arbitrary code via a large image file that is used as a background...

CVE-2005-0686

CVE-2005-0686 affects mlterm versions 2.5.0 through 2.9.1 when compiled with gtk/gdk-pixbuf support. The issue is an integer overflow triggered by a specially crafted large background image, enabling remote code execution with user privileges. Public reports/entries consistently describe the vuln...

CVE-2005-0686

Integer overflow in mlterm 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, allows remote attackers to execute arbitrary code via a large image file that is used as a background...