14488 matches found
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in smarty/smartyclass.php in Shop-Script FREE allow remote attackers to execute arbitrary PHP code via a URL in the 1 smartycompilepath, 2 smartycompilepath, 3 getpluginfilepath, 4 smartydir, and 5 filename parameters. NOTE: this issue might be...
Sql injection
SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, different vectors than CVE-2006-3341...
CVE-2006-7191
Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager LAM before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program...
CVE-2006-7191
Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager LAM before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program...
CVE-2006-7191
Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager LAM before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program...
CVE-2006-7188
The CVE-2006-7188 entry concerns WebAPP by web-app.net. Affected component: the search.pl in cgi-lib/user-lib. Before 20060909, remote attackers could read internal forum posts by crafting certain requests, with the issue possibly tied to the $info{'forum'} variable. The provided sources confirm ...
CVE-2006-7187
Cross-site scripting XSS vulnerability in the showrecentsearches function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to inject arbitrary web script or HTML via the srch variable...
CVE-2006-7190
CVE-2006-7190 describes a Cross-site Scripting (XSS) vulnerability in the cgi-bin/user-lib/topics.pl component of WebAPP (web-app.net) prior to 20060515. The issue allows remote attackers to inject arbitrary web scripts or HTML through unknown vectors in the viewnews function, with the root cause...
CVE-2006-7191
The CVE-2006-7191 vulnerability affects LDAP Account Manager (LAM) via lamdaemon.pl, where an untrusted PATH can let local users execute a malicious rm and gain privileges. Public advisories (DSA-1287-1 for Debian) confirm the issue and provide remediation by upgrading ldap-account-manager to a f...
CVE-2006-7189
CVE-2006-7189 describes a cross-site scripting (XSS) vulnerability in the web-app.net WebAPP product, specifically in the shell path CGI-bin/admin/logs.cgi, prior to version 20060403. The flaw allows remote attackers to inject arbitrary web script or HTML through unspecified vectors related to th...
CVE-2006-7186
The CVE-2006-7186 entry concerns WebAPP (WebAPP) CGI component cgi-lib/subs.pl, affected in versions before 0.9.9.3.5. The vulnerability enables attackers to open list files in the profile and other functions, per the description, and is noted as distinct from CVE-2005-0927. No remediation steps ...
Snort 2.6.1 DCE/RPC Preprocessor Remote Buffer Overflow Exploit (linux)
No description provided by source. !/usr/bin/python Remote exploit for Snort DCE/RPC preprocessor vulnerability as described in CVE-2006-5276. The exploit binds a shell to TCP port 4444 and connects to it. This code was tested against snort-2.6.1 running on Red Hat Linux 8 Author shall bear no...
CVE-2006-7187
The CVE-2006-7187 entry documents a Cross-site scripting (XSS) vulnerability in the WebAPP product where the show_recent_searches function (cgi-lib/user-lib/search.pl) accepts user-controlled input via the srch parameter. Affects WebAPP prior to 2006-09-09; exploitable by remote attackers to inje...
Code injection
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service crash or possibly execute arbitrary code via crafted arguments to the 1...
CVE-2007-1794
The Javascript engine in Mozilla 1.7 and earlier on Sun Solaris 8, 9, and 10 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used. NOTE: this issue might be related to CVE-2006-3805...
Design/Logic Flaw
The Javascript engine in Mozilla 1.7 and earlier on Sun Solaris 8, 9, and 10 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used. NOTE: this issue might be related to CVE-2006-3805...
CVE-2006-5820
Summary (CVE-2006-5820): AOL's SuperBuddy ActiveX control (Sb.SuperBuddy.1) exposes the LinkSBIcons() method. The vulnerability arises when an attacker-provided address is dereferenced as a function pointer, enabling remote code execution. Impact is remote, unauthenticated, requiring a user to vi...
CVE-2007-1793
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service crash or possibly execute arbitrary code via crafted arguments to the 1...
linux/x86 raw-socket ICMP/checksum shell 235 byte
No description provided by source. ; ; Copyright c 2007 by [email protected] ; ; 235-byte raw-socket ICMP/checksum shell - x86-lnx ; by mu-b - Nov 2006 ; ; icmp with identifier flagbyte and commands in the ; following format:- ; "/bin/sh\x00-c\x00command here\x00" ; ; unlike other icmp shells,...
