phpMyAdmin preg_replace()远程PHP代码执行

BUGTRAQ ID: 59460 CVECAN ID: CVE-2013-3238 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 phpMyAdmin 3.5.8、4.0.0-rc2及其他版本的pregreplace函数可被利用在服务器端执行任意PHP代码，攻击者用特制参数作为常规表达式，在此表达式内包含空字节，当phpMyAdmin使用"Replace table prefix"功能时，会错误地过滤传递到pregreplace的特制参数。导致在Web服务器上下文中执行任意PHP代码。 0...

CVE-2013-0798: Undefined Security Weakness

Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the apptmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which apptmp is used...

CentOS Update for firefox CESA-2013:0271 centos5

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2013:0271 centos5 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

ChillyCMS 1.3.0 - Multiple Vulnerabilities

ChillyCMS 1.3.0 - Multiple Vulnerabilities Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: "powered by chillyCMS" Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link:...

Websitebaker Add-on Concert Calendar 2.1.4 Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability Advisory ID: SSCHADV2013-001 Author: Stefan Schurtz Affected Software: Successfully tested on Concert Calendar 2.1.4 Vendor URL:...

Yahoo Mail XSS Vulnerability Could Affect Millions of Accounts

Security researcher Shahin Ramezany developed an XSS proof-of-concept exploit that he claims puts some 400 million Yahoo Mail users at risk of having their accounts taken over. In a video posted on YouTube last night, Ramezanydemonstrated an exploit for what he claims is a document object...

DSA-2583-1 iceweasel - several

Bulletin has no description...

PT-2013-1495

Name of the Vulnerable Software and Affected Versions yast2-add-on-creator in SUSE inst-source-utils versions 2008.11.26 through 2008.11.26-0.9.0 yast2-add-on-creator in SUSE inst-source-utils versions 2012.9.13 through 2012.9.13-0.8.0 Description The issue allows local users to gain privileges v...

CVE-2012-4201

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

CVE-2012-4205

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery CSRF attacks or obtain sensitive...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2012-4205

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery CSRF attacks or obtain sensitive...

CVE-2012-4201

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

CVE-2012-4205: Cross-Site Request Forgery (CSRF)

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery CSRF attacks or obtain sensitive...

CVE-2012-4205

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery CSRF attacks or obtain sensitive...

PT-2012-5244

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 17.0 Firefox ESR versions prior to 10.0.11 Thunderbird versions prior to 17.0 Thunderbird ESR versions prior to 10.0.11 SeaMonkey versions prior to 2.14 Description The issue allows remote attackers to conduct...

PT-2012-5248

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 17.0 Thunderbird versions prior to 17.0 SeaMonkey versions prior to 2.14 Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks or obtain sensitive information by...

XMLHttpRequest inherits incorrect principal within sandbox — Mozilla

Mozilla developer Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal. This can lead to cross-site request forgery CSRF or information theft via an add-on running untrusted code in a sandbox...

Mozilla: Fixes for Location object issues (MFSA 2012-90)

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...

Mozilla: Fixes for Location object issues (MFSA 2012-90)

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easie...