Cisco Unified Communications Manager key参数SQL注入漏洞

BUGTRAQ ID: 27775 CVECAN ID: CVE-2008-0026 Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 CUCM的管理员和用户界面页面的key参数存在SQL注入漏洞，远程攻击者可能利用此漏洞获取敏感信息。 攻击者可以在管理员或用户界面页面的key参数中输入特制值触发SQL注入漏洞，可通过Web界面使用http或https协议来执行攻击，成功攻击可以终止SQL调用，强制到后端数据库的连接，导致泄露敏感信息，如用户名和口令哈希。 Cisco...

Microsoft IIS ASP远程代码执行漏洞（MS08-006）

BUGTRAQ ID: 27676 CVECAN ID: CVE-2008-0075 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 IIS处理ASP网页输入的方式存在远程代码执行漏洞，允许攻击者向网站的ASP页面传送恶意输入。成功利用这个漏洞的攻击者可以在IIS服务器上以WPI的权限（默认配置为网络服务帐号权限）执行任意操作。 Microsoft IIS 6.0 Microsoft IIS 5.1 临时解决方法： 在Windows Server 2003上禁用传统风格ASP： 1...

CVE-2007-6313

MySQL Server 5.1.x before 5.1.23 and 6.0.x before 6.0.4 does not check the rights of the entity executing BINLOG, which allows remote authorized users to execute arbitrary BINLOG statements...

Sql injection

SQL injection vulnerability in detail.php in iTechBids Gold 6.0 allows remote attackers to execute arbitrary SQL commands via the itemid parameter...

CVE-2008-0776

SQL injection vulnerability in detail.php in iTechBids Gold 6.0 allows remote attackers to execute arbitrary SQL commands via the itemid parameter...

CVE-2008-0776

CVE-2008-0776 concerns SQL injection in iTechBids Gold 6.0’s detail.php via the item_id parameter. The vulnerability enables remote attackers to alter or disclose database data by crafting input that is not properly sanitized. Affected component is the detail.php script; root cause is improper ha...

Microsoft Security Bulletin MS08-008 – Critical Vulnerability in OLE Automation Could Allow Remote Code Execution (947890)

Microsoft Security Bulletin MS08-008 – Critical Vulnerability in OLE Automation Could Allow Remote Code Execution 947890 Published: February 12, 2008 Version: 1.0 General Information Executive Summary This critical security update resolves a privately reported vulnerability. This vulnerability...

ITechBids 6.0 - item_id SQL Injection

ITechBids 6.0 - itemid SQL Injection ITechBids v.6.0 Gold Edition Sql Injection Exploit AUTHOR:SoSo H H Iraqi-Cracker Script Site: http://itechscripts.com/ Price:$125.00 Exploit in: detail.php?itemid==SQL Example:...

PHP-Nuke 8.0 - sid SQL Injection

PHP-Nuke 8.0 - sid SQL Injection version Tested on 7.9 & 6.0 '; if $argc table prefix\n"; print "ex.: " . $argv0 . " phpnuke.org 7\n"; credits; exit; / few definitions / if empty$argv3 $prefix = 'nuke'; define tables prefix else $prefix = $argv3; switch $argv2 case "6": $query...

CVE-2008-0216

The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the ptchown function, which might allow local users to read data from the pty from another user...

Buffer overflow

Buffer overflow in Microsoft Visual InterDev 6.0 SP6 allows user-assisted attackers to execute arbitrary code via a Studio Solution .SLN file with a long Project line...

Microsoft Visual InterDev 6.0 (SP6) .sln File Local Buffer Overflow Exploit

Exploit for unknown platform in category local exploits =========================================================================== Microsoft Visual InterDev 6.0 SP6 .sln File Local Buffer Overflow Exploit =========================================================================== usage: exploit....

Discuz! "$_SERVER['PHP_SELF']" XSS Vulnerability

在common.inc.php文件的69行： $PHPSELF = $SERVER'PHPSELF' ? $SERVER'PHPSELF' : $SERVER'SCRIPTNAME'; $SCRIPTFILENAME = strreplace'\\', '/', isset$SERVER'PATHTRANSLATED' ? $SERVER'PATHTRANSLATED' : $SERVER'SCRIPTFILENAME'; $boardurl = 'http://'.$SERVER'HTTPHOST'.pregreplace"//+api|archiver|wap?/$/i",...

MS Internet Explorer 6.0 (mshtmled.dll) Denial of Service Exploit

No description provided by source. !-- Internet Explorer 'mshtmled.dll' 6.0 Denial Of Service Release Date: October 24, 2005 Date Reported: August 14, 2005 Severity: Medium Vendor: Microsoft Versions Affected: Internet Explorer 6.0 on Windows XP SP2 Overview:...

Directory traversal

MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a table on which the us...

Apple QuickTime 7.27.3 - RSTP Response Universal

Apple QuickTime 7.27.3 - RSTP Response Universal Everyone Loves O|0+|O the Hypnotoad... |...| | | =o0O=====O0o=============================== | QuickTime RTSP Response Content-type | | remote stack rewrite exploit for IE 6/7 | | by Yag Kohha skyhole at gmail.com |...

CVE-2007-6044

Technical details for CVE-2007-6044 are not publicly available in the provided documents. Monitor for updates; no concrete affected product/version or impact is disclosed here.

Six Remote Memory Corruption Vulnerabilities in IBM WebSphere MQ 6.0

IRM, leaders in messaging systems security, have discovered six remote vulnerabilities in IBM WebSphere MQ 6.0. The vulnerabilities are currently being investigated by IBM and once patches have been developed, advisories will be published including full technical details and links to patch downlo...

F5 Networks FirePass 4100 SSL VPN - Download_Plugin.php3 Cross-Site Scripting

F5 Networks FirePass 4100 SSL VPN - DownloadPlugin.php3 Cross-Site Scripting source: https://www.securityfocus.com/bid/26661/info F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may...

CVE-2002-2285

Vulnerability summary: In eTrust InoculateIT 6.0, enabling the "Incremental Scan" option may certify a file as virus-free before it is fully downloaded, allowing a bypass of virus detection. Affected product/version: eTrust InoculateIT 6.0. Root cause / behavior: premature virus validation during...