JAF CMS Forum.PHP远程文件包含漏洞

Salims Softhouse JAF CMS是一款基于PHP的内容管理程序。 Salims Softhouse JAF CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Forum.PHP'脚本对用户提交的'applAPPL'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Salims Softhouse JAF CMS 4.0 RC1 Salims Softhouse JAF CMS 3.0 RC Salims Softhouse JAF CMS 2.5 Salims Softhous...

Typo3 3.7/3.8/4.0 - 'Class.TX_RTEHTMLArea_PI1.php' Multiple Remote Command Execution Vulnerabilities

source: https://www.securityfocus.com/bid/21680/info TYPO3 is prone to multiple vulnerabilities that allow attackers to execute arbitrary commands. This issue occurs because the application fails to properly sanitize user-supplied data. Exploiting these issues allows unauthenticated attackers to...

Important: Red Hat Security Advisory: php security update for Stronghold

Updated PHP packages that fix multiple security issues are now available for Stronghold 4.0 for Enterprise Linux. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web...

Microsoft Internet Explorer IMSKDIC.DLL拒绝服务漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer实例化IMSKDIC.DLL COM对象存在问题，远程攻击者可以利用漏洞进行内存破坏攻击，可能以进程权限执行任意指令。 当Microsoft Internet Explorer尝试以ActiveX控件实例化IMSKDIC.DLLMicrosoft IME COM对象，可能破坏系统内存造成拒绝服务，可能导致任意代码执行。 Microsoft Internet Explorer 6.0 SP2 Microsoft Internet Explorer 6.0...

Microsoft Internet Explorer MSOE.DLL拒绝服务漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer实例化msoe.dll COM对象存在问题，远程攻击者可以利用漏洞进行内存破坏攻击，可能以进程权限执行任意指令。 当Microsoft Internet Explorer尝试以ActiveX控件实例化msoe.dll COM对象，可能破坏系统内存造成拒绝服务，可能导致任意代码执行。 Microsoft Internet Explorer 6.0 SP2 Microsoft Internet Explorer 6.0 SP1 Microsoft...

JustSystems多个产品未明缓冲区溢出漏洞

Justsystem公司包含多个设计通用软件产品。 Justsystem多个产品在处理文档时存在缓冲区溢出攻击，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 Justsystem Sanshiro 2005 Justsystem Ichitaro viewer 4.0 Justsystem Ichitaro Lite2 R2 Justsystem Ichitaro Lite2 0 Justsystem Ichitaro 2006 Justsystem Ichitaro 2005 Justsystem Ichitaro 0 Justsystem...

Microsoft Internet Explorer ADODB.Recordset NextRecordset拒绝服务漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer处理ADODB.Recordset NextRecordset对象存在问题，远程攻击者可以利用漏洞可对应用程序进行拒绝服务攻击。 构建包含恶意ADODB.Recordset NextRecordset对象的WEB页，诱使用户访问，可导致用户的IE浏览器崩溃，造成拒绝服务攻击。可能存在任意代码执行可能。 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Microso...

CVE-2006-6186

Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. dot dot in the dir parameter to 1 config.php, 2 ranklvinside.php, 3 rankmlinside.php, and 4 admin/Restore/config.php...

CVE-2006-6186

CVE-2006-6186 affects enomphp 4.0, introducing multiple directory traversal vulnerabilities. A crafted .. in the dir parameter to config.php, ranklv_inside.php, rankml_inside.php, or admin/Restore/config.php enables reading arbitrary files. The documents do not provide exploit details, mitigation...

CVE-2006-6186

Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. dot dot in the dir parameter to 1 config.php, 2 ranklvinside.php, 3 rankmlinside.php, and 4 admin/Restore/config.php...

CVE-2006-6164

The CVE-2006-6164 entry concerns OpenBSD 3.9 and 4.0 where the _dl_unsetenv function in loader.c of the ELF ld.so fails to remove duplicate environment variables. This could allow local users to pass dangerous variables (e.g., LD_PRELOAD) to loading processes, potentially enabling privilege escal...

CVE-2006-6025

QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. As of 20061118, this disclosure has no...

OpenBSD 3.9/4.0 - 'ld.so' Local Environment Variable Clearing

/ source: https://www.securityfocus.com/bid/21188/info OpenBSD is prone to a local vulnerability that may allow attackers to pass malicious environment variables to applications, bypassing expected security restrictions. Attackers may be able to exploit this issue to execute arbitrary code with...

Microsoft XML核心服务XMLHTTP控件内存破坏漏洞（MS06-071）

Microsoft XML核心服务（MSXML）允许使用JScript、VBScript和Microsoft Visual Studio 6.0的用户构建可与其他符合XML 1.0标准的应用程序相互操作的XML应用。 在Microsoft XML Core Services的XMLHTTP 4.0...

CVE-2006-5935

SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter...

StoryStream 4.0 (baseDir) Remote File Include Vulnerabilities

v1per-haCker How I Can lives Without FooL Programmer! ======================================================================================= Storystream RFI ======================================================================================= Information:- Scripts: Storystream download :...

StoryStream 4.0 (baseDir) Remote File Include Vulnerabilities

r0ut3r Presents... Another r0ut3r discovery! ContentNow 1.30 Local File Include & Arbitrary File Upload/Delete Vulnerabilities Software: ContentNow 1.30 Vulnerabilities Vendor: http://www.contentnow.mf4k.de/ Released: 2006/11/13 Discovered By: r0ut3r writ3r at gmail.com...

StoryStream 4.0 (baseDir) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ============================================================= StoryStream 4.0 baseDir Remote File Include Vulnerabilities ============================================================= v1per-haCker How I Can lives Without FooL Programmer!...

ShopSystems Index.PHP SQL 注入漏洞

ShopSystems Index.PHP SQL 注入漏洞,因为它并没有足够的过滤用户提供数据,然后用它的SQL查询. 一个可以让攻击者利用此问题上妥协的申请,获得或更改资料,或者利用潜在脆弱执行基本数据库. ShopSystems ShopSystems 4.0版本与之前的存在此漏洞; 其他版本也可能受到影响. ShopSystems ShopSystems 4.0 [email protected]...

CVE-2006-5745

CVE-2006-5745 describes a memory-corruption vulnerability in the XMLHTTP ActiveX Control (MSXML4) used by Internet Explorer on Windows, enabling remote code execution when an attacker crafts arguments to setRequestHeader in the XMLHTTP 4.0 control. The issue affects Microsoft XML Core Services 4....