Debian: Security Advisory (DSA-3013-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-3013

CVE-2012-3013 affects WAGO I/O System 758 family Industrial PCs (models 758-870, 758-874, 758-875, 758-876). The issue is caused by default passwords for unspecified Web-Based Management accounts, enabling remote attackers to obtain administrative access over TCP. Connected Red Hat records refere...

Gentoo Security Advisory GLSA 201206-03 (Opera)

The remote host is missing updates announced in advisory GLSA 201206-03. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

WAGO IO 758 Default Linux Credentials

Overview This advisory updates the ICS-CERT Alert titled “ICS-ALERT-12-097-01 - WAGO IPC Vulnerabilities” that was posted on the ICS-CERT Web site on April 06, 2012. This alert detailed a vulnerability report of “hard-coded” credentials and improper access controls in the WAGO I/O System 758...

CVE-2011-3013

The CVE-2011-3013 entry affects WebAdmin in Mobility Pack before 1.2 within Novell Data Synchronizer 1.x up to 1.1.2 build 428. The underlying issue is the use of weak SSL ciphers, enabling a remote attacker to potentially gain access via brute-force attempts. Documented impact is partial confide...

CVE-2010-3013

CVE-2010-3013 is a SQL injection vulnerability in Pligg before 1.1.1, caused by unsafely handling the role parameter in groupadmin.php. The issue is exploitable remotely and allows an attacker to inject arbitrary SQL commands. This CVE is distinct from CVE-2010-2577. Connected sources confirm the...

CVE-2010-3013

SQL injection vulnerability in groupadmin.php in Pligg before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the role parameter, a different vulnerability than CVE-2010-2577...

Pligg Multiple SQL Injection Vulnerabilities

The host is running Pligg CMS and is prone to multiple SQL injection vulnerabilities. OpenVAS Vulnerability Test $Id: gbpliggmultsqlinjvuln.nasl 5373 2017-02-20 16:27:48Z teissa $ Pligg Multiple SQL Injection Vulnerabilities Authors: Sooraj KS Upadated By: Antu Sanadi on 2010-08-16 - Added the...

CVE-2009-3013

The CVE-2009-3013 issue affects Opera 9.52 and earlier, and Opera 10.00 Beta 3 Build 1699, where data: URIs in HTTP Location headers were not properly blocked, enabling cross-site scripting (XSS) via two vectors: (1) a Location header containing JavaScript sequences in a data:text/html URI, and (...

CVE-2008-3013

creationtimestamp| type| source ---|---|--- 2008-10-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6716...

CVE-2008-3013

CVE-2008-3013 corresponds to a GDI+ GIF parsing vulnerability. The connected KB954593 (MS08-052) describes remote code execution in Windows GDI+ when a user views a specially crafted GIF, affecting multiple Windows versions and Office components. The underlying issue is memory corruption during G...

Windows GDI+ GIF memory corruption

There is a memory corruption vulnerability with GIF file processing in Microsoft GDI+ that can be used to crash a vulnerable application and potentially execute arbitrary code. The vulnerability The vulnerability is caused due to improper handling of graphic control extension when processing...

ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability

ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-056 September 9, 2008 -- CVE ID: CVE-2008-3013 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Server 2008 Microsoft Windows XP Microsoft Windows...

MS08-052: Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593)

The remote host is running a version of Windows that has multiple buffer overflow vulnerabilities when viewing VML, EMF, GIF, WMF and BMP files that could allow an attacker to execute arbitrary code on the remote host. To exploit these flaws, an attacker would need to send a malformed image file ...

Microsoft Windows GDI+ GIF Parsing Buffer Overflow (MS08-052; CVE-2008-3013)

Graphics Interchange Format GIF images are 8-bit files that support transparency, compression, interlacing, and multiple-image pictures animated GIFs. A remote code execution vulnerability has been discovered in the way GDI+ parses GIF images. The vulnerability is due to a buffer overrun when GDI...

CVE-2007-3013

CVE-2007-3013 affects activeWeb contentserver: SQL injection in the picture_real_edit.asp endpoint (id parameter) that can be exploited by editors with edit permission to execute arbitrary SQL. Affected versions were

rt-sa-2007-004.txt

Advisory: ActiveWeb Contentserver CMS SQL Injection Management Interface RedTeam Pentesting discovered an SQL Injection in the picturerealedit.asp script of the activeWeb contentserver CMS during a penetration test. An editor with the permission to edit pictures can exploit this by injecting...

[Full-disclosure] ActiveWeb Contentserver CMS SQL Injection Management Interface

Advisory: ActiveWeb Contentserver CMS SQL Injection Management Interface RedTeam Pentesting discovered an SQL Injection in the picturerealedit.asp script of the activeWeb contentserver CMS during a penetration test. An editor with the permission to edit pictures can exploit this by injecting...

rt-sa-2006-005.txt

Advisory: Unauthorized password recovery in phpBannerExchange RedTeam identified an SQL injection that can be triggered due to a bad user input sanitization in phpBannerExchange. It is possible to recover a password of an user and thereby overtake his account. Details ======= Product:...

CVE-2006-3013

Interpretation conflict in resetpw.php in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via an email parameter containing a null %00 character after a valid e-mail address, which passes the validation check in the eregi PHP command. NOTE: it could...