openSUSE 10 Security Update : pcre (pcre-4708)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code CVE-2006-7230. %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : pcre (pcre-4750)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code CVE-2006-7230. %NASLMINLEVEL 70300 C Tenable...

apache-mod-rewrite.rb.txt

require 'msf/core' module Msf class Exploits::Windows::Http::Apachemodrewrite 'Apache ModRewrite escapeabsoluteuri Off-By-One Buffer Overflow', 'Description' = %q This module exploits a off-by-one buffer overflow. RewriteRule must be enabled and rule must meets this criteria: beginning of the...

Webmin File Disclosure

A vulnerability has been reported in Webmin and Usermin, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an unspecified error within the handling of an URL. This can be exploited to read the contents of any files on the...

Novell Groupwise Windows客户端API非授权邮件访问漏洞

BUGTRAQ ID: 18716 CVECAN ID: CVE-2006-3268 Novell GroupWise是一款跨平台协作软件。 Novell GroupWise的客户端API实现上存在漏洞，攻击者可能利用漏洞绕过安全限制，访问某些非授权的邮件。 Novell Groupwise 7.x Novell Groupwise 6.x Novell Groupwise 5.x 厂商补丁： Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： GroupWise 6.5: Apply SP6 Client Update 1...

Mutt BROWSE_GET_NAMESPACE IMAP名称空间处理远程溢出漏洞

BUGTRAQ ID: 18642 CVECAN ID: CVE-2006-3242 Mutt是一个小型但功能强大的基于文本的MIME邮件客户端。 Mutt处理畸形邮件时存在漏洞，远程攻击者可能利用此漏洞在客户端上执行任意指令。 Mutt的browse.c文件的browsegetnamespace函数中存在缓冲区溢出漏洞。如果恶意的IMAP服务器向Mutt发送了超长的名称空间的话，就会触发这个漏洞，导致客户端崩溃或执行任意指令。 Mutt Mutt 1.4.2 Gentoo Linux 厂商补丁： Mutt ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Design/Logic Flaw

QK SMTP Server 3 allows remote attackers to cause a denial of service daemon crash via a long 1 HELO, 2 MAIL FROM, or 3 RCPT TO command; or 4 a long string in the message sent after the DATA command; possibly a related issue to CVE-2006-5551...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFapproot parameter to 1 tcuser.class.php, 2 absencecount.inc.php, 3 avatar.inc.php, 4 csvhandler.class.php, 5 functions.tcpro.php, 6...

CVE-2007-6558

TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service application crash via a large .m3u file. NOTE: this might be a duplicate of CVE-2006-6288...

CVE-2007-6553

The CVE-2007-6553 entries describe multiple PHP remote file inclusion vulnerabilities in TeamCal Pro (versions up to 3.1.000 and earlier) that allow remote attackers to execute arbitrary PHP code by supplying a URL in the CONF[app_root] parameter to various includes/modules (e.g., tcuser.class.ph...

TWiki脚本文件上传漏洞

BUGTRAQ ID: 18854 CVECAN ID: CVE-2006-3336 TWiki是一款灵活易用、功能强大的企业协作平台。 TWiki对上传文件的后缀检查过滤不充分，远程攻击者可能利用此漏洞上传脚本文件执行，从而以Web进程权限在服务器上执行任意命令。 TWiki上传过滤器可以在上传的文件名后附加.txt后缀，以防执行.php、.php1、.phps、.pl之类的可执行脚本。但是，PHP和其他一些类型允许额外的文件后缀，如.php.en、.php.1和.php.2等。TWiki没有检查这些后缀，也就是可能没有添加.txt文件名后缀便上传一些PHP脚本，导致执行任意代码。 0...

RealPlayer 10.5 (6.0.12.1040-1348) SWF Buffer Overflow PoC

No description provided by source. !/usr/bin/perl RealPlayer: Buffer overflow vulnerability / PoC CVE-2006-0323 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323 RealNetworks Advisory http://service.real.com/realplayer/security/03162006player/en/ Federico L. Bossi Bonin ...

WebEx Downloader插件远程代码执行漏洞

BUGTRAQ ID: 18860 CVECAN ID: CVE-2006-3423 WebEx是全球最大的网络通信服务供应商，可提供电信级网络会议解决方案。 WebEx在处理组件下载操作时存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意命令。 WebEx在召开或加入网络会议时需要使用Downloader插件来下载一些额外的组件。在下载时由于对各种ActiveX/Java控件参数和配置指令缺少验证，GpcUrlRoot和GpcIniFileName...

eSyndiCat Link Exchange Script 2005-2006 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== eSyndiCat Link Exchange Script 2005-2006 SQL Injection Vulnerability ====================================================================...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808)

This update fixes multiple bugs in php : - use system pcre library to fix several pcre vulnerabilities. CVE-2007-1659 / CVE-2006-7230 / CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 / CVE-2006-7228 - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars. CVE-2007-5898 - overly...

OpenSSL < 0.9.7l / 0.9.8d SSLv2 Client Crash Exploit

No description provided by source. !/usr/bin/perl Copyrightc Beyond Security Written by Noam Rathaus - based on beSTORM's SSL Server module Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket;...

Debian DSA-1436-1 : linux-2.6 - several vulnerabilities

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-6058 LMH reported an issue in the minix filesystem that...

OpenSSL < 0.9.7l / 0.9.8d SSLv2 Client Crash Exploit

Exploit for multiple platform in category dos / poc ==================================================== OpenSSL '443', Proto = 'tcp', Listen = 1, Reuse = 1, ; die "Could not create socket: $!\n" unless $sock; my $TIMEOUT = 0.5; my $line; my $newsock; srandtime; while $newsock = $sock-accept prin...

OpenSSL < 0.9.7l/0.9.8d - SSLv2 Client Crash

!/usr/bin/perl Copyrightc Beyond Security Written by Noam Rathaus - based on beSTORM's SSL Server module Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket; my $sock = new IO::Socket::INET LocalPort = '443',...

[SECURITY] [DSA 1436-1] New Linux 2.6.18 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1436-1 [email protected] http://www.debian.org/security/ dann frazier December 20th, 2007 http://www.debian.org/security/faq -...