PHP php-cgi Query String Parameter Code Execution (CVE-2012-1823; CVE-2012-2311; CVE-2012-2335; CVE-2012-2336; CVE-2013-4878)

A remote code execution vulnerability has been reported in PHP. The vulnerability is due to the improper parsing and filtering of query strings by PHP. A remote attacker may exploit this issue by sending crafted HTTP requests. Successful exploitation would allow an attacker to execute arbitrary...

CVE-2012-2335

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgimain.c component and a query string beginning with a +...

CVE-2012-2335

CVE-2012-2335 affects PHP when executed via CGI; php-wrapper.fcgi mishandles command-line arguments, enabling remote code execution by exploiting interaction between sapi/cgi/cgi_main.c and a query string starting with a +-, affecting PHP 5.3.12 and 5.4.2. The description notes that an attacker c...

Mandriva Linux Security Advisory : php (MDVSA-2012:068-1)

A vulnerability has been found and corrected in php-cgi : PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. A remote unauthenticated attacker could obtain sensitive information, cause a denial of service condition or may be able to execute arbitrary...

PHP < 5.3.13, 5.4.x < 5.4.3 Multiple Vulnerabilities - Active Check

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.103482"...

Debian DSA-2335-1 : man2html - missing input sanitization

Tim Starling discovered that the Debian-native CGI wrapper for man2html, a program to convert UNIX man pages to HTML, is not properly escaping user-supplied input when displaying various error messages. A remote attacker can exploit this flaw to conduct cross-site scripting XSS attacks...

CVE-2010-2335

SQL injection vulnerability in index.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to execute arbitrary SQL commands via the news parameter...

CVE-2010-2335

CVE-2010-2335 describes a SQL injection in Yamamah Photo Gallery 1.00 (pre-20100618) via the news parameter in index.php, allowing remote attackers to execute arbitrary SQL commands. The description confirms the vulnerable component (index.php, news parameter) and the affected version range, with...

SLES9: Security update for fetchmail

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: fetchmail For more information, please visit the referenced security advisories. More details may also be found by searching for keyword 5012536 within the...

Fedora Core 10 FEDORA-2009-8538 (wordpress-mu)

The remote host is missing an update to wordpress-mu announced via advisory FEDORA-2009-8538. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 11 FEDORA-2009-8529 (wordpress-mu)

The remote host is missing an update to wordpress-mu announced via advisory FEDORA-2009-8529. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-7729 (wordpress)

The remote host is missing an update to wordpress announced via advisory FEDORA-2009-7729. OpenVAS Vulnerability Test $Id: fcore20097729.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-7729 wordpress Authors: Thomas Reinke Copyright: Copyright c 200...

Fedora Core 10 FEDORA-2009-7729 (wordpress)

The remote host is missing an update to wordpress announced via advisory FEDORA-2009-7729. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Fedora Core 11 FEDORA-2009-7701 (wordpress)

The remote host is missing an update to wordpress announced via advisory FEDORA-2009-7701. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

WordPress / WordPress MU Multiple Vulnerabilities (Jul 2009)

WordPress / WordPress MU is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-2335

CVE-2009-2335 affects WordPress and WordPress MU prior to 2.8.1, where a failed login behaves differently depending on whether the user account exists, enabling remote enumeration of valid usernames. The vendor reportedly disputes the significance of the issue, calling the behavior for user conve...

WordPress口令重置用户名枚举漏洞

BUGTRAQ ID: 35581 CVECAN ID: CVE-2009-2335,CVE-2009-2336 WordPress是一款免费的论坛Blog系统。 WordPress对于使用已有的用户名和不存在用户名的登录尝试会返回不同的结果，这降低了暴力猜测攻击的复杂性；此外在使用口令重置界面请求新口令的时候，对于已有的和不存在的用户名也会返回不同的结果。 WordPress WordPress 2.6.5 WordPress WordPress MU 2.7.1 WordPress ---------...

WordPress Privileges Unchecked in admin.php and Multiple Information

Exploit for unknown platform in category web applications ==================================================================== WordPress Privileges Unchecked in admin.php and Multiple Information ==================================================================== -----BEGIN PGP SIGNED MESSAGE---...

WordPress Privileges Unchecked in admin.php and Multiple Information

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ WordPress Privileges Unchecked in admin.php and Multiple Information Disclosures 1. Advisory Information Title: WordPress Privilege...

WordPress Core / MU / Plugins - '/admin.php' Privileges Unchecked / Multiple Information Disclosures

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ WordPress Privileges Unchecked in admin.php and Multiple Information Disclosures 1. Advisory Information Title: WordPress Privileges Unchecked in admin.php and Multip...