Apache 2.2 - Scoreboard Invalid Free On Shutdown

Source: http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/ Introduction Apache 2.2 webservers may use a shared memory segment to share child process status information scoreboard between the child processes and the parent process running as root. A child running with lowe...

Android SD卡内容信息泄露漏洞

BUGTRAQ ID: 45048 Android是Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。 Android的实现上存在一些问题，远程攻击者可利用此漏洞获取设备SD卡的文件，造成敏感信息泄露。...

CVE-2011-4203

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable...

Traq 'authenticate()'函数远程代码执行漏洞

Bugtraq ID: 50961 Traq是一款基于PHP/MySQL的项目管理软件 定义在/admincp/common.php中的authenticate函数存在错误： 27. function authenticate 28. 29. global $user; 30. 31. if!$user-group'isadmin' 32. header"Location: login.php"; 33...

Apache HTTP Server mod_proxy反向代理模式安全限制绕过漏洞

BUGTRAQ ID: 50802 CVE ID: CVE-2011-4317 Apache HTTP Server是Apache软件基金会的一个开放源代码的网页服务器，可以在大多数电脑操作系统中运行，由于其跨平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server在反向代理模式中配置modproxy模块时错误地处理了某些Web请求，可通过特制的URL向代理后方的服务器发送请求，从而绕过某些安全限制。 Apache 2.2.x Apache 2.0.x 厂商补丁： Apache Group ------------...

Apache 2.2 < 2.2.21 mod_proxy_ajp DoS

Binary data 6062.prm...

Apache 2.2 < 2.2.21 mod_proxy_ajp DoS

Binary data 800559.prm...

Remote file inclusion

PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the pathForArdeaCore parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-4998

CVE-2010-4998 affects the ardeaCore PHP Framework 2.2. A PHP remote file inclusion flaw in ardeaCore/lib/core/ardeaInit.php allows an attacker to execute arbitrary PHP code via a URL supplied to the pathForArdeaCore parameter. NVD records a base CVSS v2 score of 7.5 (HIGH) with network access and...

CVE-2010-5012

CVE-2010-5012 describes a SQL injection in DaLogin 2.2 and 2.2.5, exploitable via the id parameter in new.php. The vulnerability allows remote attackers to execute arbitrary SQL commands. The NVD entry lists a base CVSS v2 score of 7.5 ( HIGH, NETWORK attack vector, no authentication required, wi...

Debian: Security Advisory (DSA-2318-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-4856

SQL injection vulnerability in arsiv.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the tarih parameter...

CVE-2010-4855

SQL injection vulnerability in oku.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the makaleid parameter...

Sql injection

SQL injection vulnerability in arsiv.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the tarih parameter...

Sql injection

SQL injection vulnerability in oku.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the makaleid parameter...

CVE-2010-4856

CVE-2010-4856 affects xWeblog 2.2, vulnerable in arsiv.asp via the tarih parameter to allow remote execution of SQL commands. The vulnerability is a SQL injection in the application, enabling partial confidentiality, integrity, and availability impact per the NVD metrics (base score 7.5). Related...

CVE-2010-4855

The CVE-2010-4855 entry describes a SQL injection in Oku.asp of xWeblog 2.2, exploitable via the makale_id parameter. The underlying issue is an injectable input vector that allows remote attackers to execute arbitrary SQL commands. Affected software is xWeblog 2.2 (Oku.asp); no specific vendor v...

CVE-2010-4856

SQL injection vulnerability in arsiv.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the tarih parameter...

CVE-2010-4855

SQL injection vulnerability in oku.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the makaleid parameter...

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/49835/info Traq is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow...