风讯API_Response.asp注入漏洞

API/APIResponse.asp变量username未经过滤传值，带入sql执行，导致注入产生。 If CheckPost Then Select Case Act Case "checkname" '触发注入 Checkname CheckPost函数原型在行73-96，username由此获取值，代码如下: XmlDoc.documentElement.selectSingleNode"username" Checkname函数在行233-254，代码如下： Sub Checkname Dim UserEmail Dim Temptr,i,Rs,Sql UserEmail =...

openbsdanim-local.txt

/ A PRODUCTION OF LUL-DISLCOSURE INC. PROUDLY PRESENTS... 888 888 888 888 888 888 .d88b. 88888b. .d88b. 88888b. 88888b. .d8888b .d88888 d88""88b 888 "88b d8P Y8b 888 "88b 888 "88b 88K d88" 888 888 888 888 888 88888888 888 888 888 888 "Y8888b. 888 888 Y88..88P 888 d88P Y8b. 888 888 888 d88P X88 Y8...

Debian DSA-1598-1 : libtk-img - buffer overflow

It was discovered that a buffer overflow in the GIF image parsing code of Tk, a cross-platform graphical toolkit, could lead to denial of service and potentially the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

PHP 5 'chdir()'和'ftok()' 'safe_mode'安全绕过漏洞

BUGTRAQ ID: 29796 CVE ID：CVE-2008-2666 CNCVE ID：CNCVE-20082666 PHP 5是一款开放源代码的网络编程语言。 PHP 5 'chdir'和'ftok'函数存在'safemode绕过问题，远程攻击者可以利用漏洞在未授权位置检测文件是否存在等敏感信息。 问题代码如下： - --- PHPFUNCTIONchdir char str; int ret, strlen; if zendparseparametersZENDNUMARGS TSRMLSCC, "s", &str, &strlen == FAILURE RETURNFALS...

CVE-2008-2776

Cross-site scripting XSS vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to inject arbitrary web script or HTML via the searchFor parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2775

SQL injection vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to execute arbitrary SQL commands via the searchFor parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2775

SQL injection vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to execute arbitrary SQL commands via the searchFor parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-2776

The CVE-2008-2776 entry describes a Cross-site scripting (XSS) vulnerability in DT Centrepiece 4.0, located in search.asp and exploitable via the searchFor parameter. The underlying issue is a failure to properly neutralize user-supplied input, enabling remote attackers to inject arbitrary web sc...

CVE-2008-2775

CVE-2008-2775 describes a SQL injection vulnerability in the search.asp page of DT Centrepiece 4.0 where the searchFor parameter can be exploited by remote attackers to execute arbitrary SQL commands. The vulnerability is documented across multiple sources (NVD/NVD mirror) with a base score of 7....

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 showfields, 2 text, and 3 submissions parameters to search.asp and the 4 name parameter to users.asp. NOTE: some of these details are...

CVE-2008-2759

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 showfields, 2 text, and 3 submissions parameters to search.asp and the 4 name parameter to users.asp. NOTE: some of these details are...

[SECURITY] [DSA 1597-1] New mt-daapd packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1597-1 [email protected] http://www.debian.org/security/ Devin Carraway June 12, 2008 http://www.debian.org/security/faq -...

Telephone Directory 2008 Arbitrary Delete Contact Exploit

No description provided by source. !/usr/bin/perl -w Telephone Directory 2008 = Arbitrary Delete Contact Founded & Exploited by : Stack Contact: Ev!L = see down Greetz : Houssamix & Djekmani & Jadi & iuoisn & hak3r-b0y All muslims HaCkeRs : Special Thnx To : Simo64 L3azzzzzz khouya...

[SECURITY] [DSA 1588-1] New Linux 2.6.18 packages fix several vulnerabilities

---------------------------------------------------------------------- Debian Security Advisory DSA-1588-1 [email protected] http://www.debian.org/security/ dann frazier May 27, 2008 http://www.debian.org/security/faq - ----------------------------------------------------------------------...

Debian Security Advisory DSA 1572-1 (php5)

The remote host is missing an update to php5 announced via advisory DSA 1572-1. OpenVAS Vulnerability Test $Id: deb15721.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1572-1 php5 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

[SECURITY] [DSA 1584-1] New libfissound packages fix execution of arbitrary code

------------------------------------------------------------------------ Debian Security Advisory DSA-1584-1 [email protected] http://www.debian.org/security/ Steve Kemp May 21, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

Debian DSA-1579-1 : netpbm-free - insufficient input sanitizing

A vulnerability was discovered in the GIF reader implementation in netpbm-free, a suite of image manipulation utilities. Insufficient input data validation could allow a maliciously-crafted GIF file to overrun a stack buffer, potentially permitting the execution of arbitrary code. %NASLMINLEVEL...

68 Classifieds 4.0 - 'category.php' SQL Injection

Remote SQL Injection Vulnerabilitie 68classifieds category.php Author : HaCkeREgY C0NTACT : [email protected] H^OME : www.PAL-HaCkeR.com & ATSDP.COM Script Name : 68classifieds Buy iT : https://www.68classifieds.com Price : Price: $199.99 ===== D0Rk : You can try ......... D: ===== ExpLO!T :...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keywords parameter to admin/index.php in a blogs search action, the 2 msgcharset and 3 msgheader9 parameters to admin/inc/header.php, and the 4 keywords...

CVE-2008-2200

Maian Weblog 4.0 is affected by multiple cross-site scripting (XSS) vulnerabilities. The CVE-2008-2200 entry specifies exploitable vectors in the web app: (1) keywords parameter to admin/index.php in a blogs search action, (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php, an...