CVE-2008-1651

EasyNews 4.0 admin/login.php is affected by a directory traversal vulnerability. An attacker can supply a ".." in the lang parameter to include and execute local files, enabling remote code execution. CVSS v2 base score 7.5 (HIGH); network access, no authentication, partial impact on confidential...

CVE-2008-1651

Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-1649

Cross-site scripting XSS vulnerability in staticpages/easypublish/index.php in EasyNews 4.0 allows remote attackers to inject arbitrary web script or HTML via the read parameter in an edppupublish action...

CVE-2008-1650

CVE-2008-1650 describes an SQL injection in EasyNews 4.0. The vulnerability exists in dynamicpages/index.php where the read parameter in the edp_Help_Internal_News action can be manipulated to execute arbitrary SQL commands. The exploitation is described as a remote, network-based vector with no ...

CVE-2008-1650

SQL injection vulnerability in dynamicpages/index.php in EasyNews 4.0 allows remote attackers to execute arbitrary SQL commands via the read parameter in an edpHelpInternalNews action...

Mcafee EPO 4.0 - FrameworkService.exe Remote Denial of Service

Mcafee EPO 4.0 - FrameworkService.exe Remote Denial of Service !/usr/bin/python Mcafee EPO 4.0 and others FrameworkService.exe DOS More than meets the eye Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/mcafeeagain.py.txt EAX 00840C30 E...

Mcafee EPO 4.0 FrameworkService.exe Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================================== Mcafee EPO 4.0 FrameworkService.exe Remote Denial of Service Exploit ==================================================================== !/usr/bin/python Mcafee EPO 4.0 and...

eggBlog 4.0 Password Retrieve Remote SQL Injection Exploit

No description provided by source. Author: GiReX mySite: girex.altervista.org Date: 27/03/2008 - 1/04/2008 Added exploit for str0ke CMS: eggBlog 4.0 Site: eggblog.net Bug: SQL Injection cookie vars Type: 1 - Admin/User Authentication Bypass Bug2: Blind SQL Injection same vars-query Type: Password...

Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service

!/usr/bin/python Mcafee EPO 4.0 and others FrameworkService.exe DOS More than meets the eye Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/mcafeeagain.py.txt EAX 00840C30 ECX 00837830 EDX 01EACF18 EBX 00004000 ESP 01EAFF04 EBP 01EAFF38...

CVE-2008-1609

CVE-2008-1609 affects JAF CMS 4.0 RC2. Connected sources describe a remote file inclusion vulnerability whereby input in the website parameter (to forum/main.php and forum/forum.php) and the main_dir parameter (to forum/forum.php) can be used to include arbitrary files, enabling arbitrary PHP exe...

eggBlog 4.0 Password Retrieve Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================== eggBlog 4.0 Password Retrieve Remote SQL Injection Exploit ========================================================== Author: GiReX Date: 27/03/2008 - 1/04/2008 Added exploit for...

多个BSD平台'strfmon()'函数整数溢出漏洞

BUGTRAQ ID: 28479 CVE ID:CVE-2008-1391 CNCVE ID:CNCVE-20081391 多个BSD平台'strfmon'函数处理存在整数溢出，可能以受影响应用程序上下文执行任意代码。失败的尝试可导致拒绝服务。 问题代码类似如下： include monetary.h ssizet strfmonchar restrict s, sizet maxsize, const char restrict format, ...; - --- 1. /usr/src/lib/libc/stdlib/strfmon.c -整数溢出...

jafcms-rfi.txt

┌┌───────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐...

JAF CMS 4.0 RC2 - Multiple Remote File Inclusions

JAF CMS 4.0 RC2 - Multiple Remote File Inclusions ??????????????????????????????????????????????????????????????????????????????? ?? C r a C k E r ?? ?? T H E C R A C K O F E T E R N A L M I G H T ?? ?????????????????????????????????????????????????????????????????????????????? ????? From The Ash...

[SECURITY] [DSA 1530-1] New cupsys packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1530-1 [email protected] http://www.debian.org/security/ Noah Meyerhans March 25, 2008 http://www.debian.org/security/faq -...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bndirdefault parameter to 1 adduser.php, 2 createforum.php, 3 createuser.php, 4 deletenotes.php, 5 deleteuser.php, 6 editforum.php, 7 mailusers.php, 8...

CVE-2008-1466

Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bndirdefault parameter to 1 adduser.php, 2 createforum.php, 3 createuser.php, 4 deletenotes.php, 5 deleteuser.php, 6 editforum.php, 7 mailusers.php, 8...

CVE-2008-1466

Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bndirdefault parameter to 1 adduser.php, 2 createforum.php, 3 createuser.php, 4 deletenotes.php, 5 deleteuser.php, 6 editforum.php, 7 mailusers.php, 8...

CVE-2008-1466

CVE-2008-1466 affects W-Agora 4.0 and allows remote PHP code execution through remote file inclusion. The vulnerability is triggered by a URL parameter bn_dir_default passed to one of nine scripts (add_user.php, create_forum.php, create_user.php, delete_notes.php, delete_user.php, edit_forum.php,...

[SECURITY] [DSA 1528-1] New serendipity packages fix cross site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1528-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 24, 2008 http://www.debian.org/security/faq -...