PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability

Advisory: PHP Inventory 1.3.1 Remote Auth Bypass SQL Injection Vulnerability Advisory ID: INFOSERVE-ADV2011-08 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on PHP Inventory 1.3.1 Vendor URL: http://www.phpwares.com/ Vendor Status: fixed CVE-ID:...

CVE-2009-5028

Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a crafted request containing an empty uri field...

CVE-2009-5028

CVE-2009-5028 affects Namazu, a full-text search engine. It is a stack-based buffer overflow in Namazu prior to 2.0.20, exploitable by a crafted request with an empty uri field, potentially causing a daemon crash or arbitrary code execution. Public sources (SUSE/Gentoo GLSA) indicate remediation ...

PHP Inventory 1.3.1 SQL Injection

Advisory: PHP Inventory 1.3.1 Remote Auth Bypass SQL Injection Vulnerability Advisory ID: INFOSERVE-ADV2011-08 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on PHP Inventory 1.3.1 Vendor URL: http://www.phpwares.com/ Vendor Status: fixed CVE-ID:...

SOL13231 - PHP vulnerability CVE-2009-2626

In PHP 5.3.0 and PHP 5.2.10 and earlier, the zendrestoreinientrycb function in zendini.c allows context-specific attackers to obtain sensitive information memory contents and causes PHP to fail by using the iniset function to declare a variable, and then using the inirestore function to restore t...

Directory traversal

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to...

CVE-2009-1523

creationtimestamp| type| source ---|---|--- 2011-11-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36318...

Oracle Database Multiple Vulnerabilities (October 2009 CPU)

The remote Oracle database server is missing the October 2009 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Application Express - Auditing - Authentication - Core RDBMS - Data Mining - Data Pump - Network...

Oracle Database Multiple Vulnerabilities (January 2009 CPU)

The remote Oracle database server is missing the January 2009 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Job Queue - Oracle OLAP - Oracle Spatial - Oracle Streams - SQLPlus Windows GUI %NASLMINLEVEL 70300 C Tenable Network...

Oracle Database Multiple Vulnerabilities (July 2009 CPU)

The remote Oracle database server is missing the July 2009 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Replication - Auditing - Config Management - Core RDBMS - Listener - Network Foundation - Secure Enterprise Search...

TYPO3 sa-2009-001 Weak Encryption Key File Disclosure

This module exploits a flaw in TYPO3 encryption ey creation process to allow for file disclosure in the jumpUrl mechanism. This flaw can be used to read any file that the web server user account has access to view. This module requires Metasploit: https://metasploit.com/download Current source:...

Mini-Stream 3.0.1.1 Buffer Overflow

This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1 By creating a specially crafted pls file, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

IBM WebSphere Application Server Admin Console Cross-site Scripting Vulnerability

The host is running IBM WebSphere Application Server and is prone to cross-site scripting vulnerability. OpenVAS Vulnerability Test $Id: gbibmwasadminconsolexssvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ IBM WebSphere Application Server Admin Console Cross-site Scripting Vulnerability Authors:...

Mini-Stream 3.0.1.1 Buffer Overflow Exploit

Exploit for windows platform in category local exploits $Id: ministream.rb 14155 2011-11-04 08:20:43Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on...

CVE-2009-0900

CVE-2009-0900 affects the IBM WebSphere MQ Client 6.x (pre-6.0.2.7) and 7.x (pre-7.0.1.0). The issue is a heap-based buffer overflow in the client when processing a Client Channel Definition Table (CCDT) file, which an attacker can exploit by supplying a crafted CCDT. This could allow a local use...

CVE-2009-0905

IBM WebSphere MQ 6.0 (before 6.0.2.8) and 7.0 (before 7.0.1.0) are affected by a vulnerability in handling long group names, which could enable local privilege escalation via combinations of groups sharing an initial substring. Affected products: WebSphere MQ 6.0 up to 6.0.2.7 and 7.0 up to 7.0.0...

CVE-2009-2747

CVE-2009-2747 affects IBM WebSphere Application Server’s JNDI implementation. The root cause is improper access control on UserRegistry object methods, allowing remote attackers to disclose sensitive information via a crafted method call. Affected versions are WAS 6.0 prior to 6.0.2.39, 6.1 prior...

CVE-2009-2748

IBM WebSphere Application Server Admin Console is affected by CVE-2009-2748: a cross-site scripting (XSS) vulnerability in the Administration Console for WAS 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Acc...

(RHSA-2011:1408) Moderate: rhev-hypervisor security update

The rhev-hypervisor package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine KVM hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red...

CVE-2009-5103

The CVE-2009-5103 entry concerns ATCOM Netvolution 1.0 ASP with a Cross-Site Scripting (XSS) vulnerability exploitable via the email variable. Connected sources corroborate an XSS condition but do not provide concrete remediation steps, affected software versions beyond 1.0 ASP, or exploit status...