CVE-2009-2653

Summary: CVE-2009-2653 affects Microsoft Windows XP (SP2/SP3) and Windows Server 2003 (pre-SP1) due to a flaw in the NtUserConsoleControl function in win32k.sys. The OpenVAS and related records describe a local privilege-escalation vulnerability in win32k.sys, enabling an administrator to elevate...

WordPress Comment Author URI跨站脚本漏洞

Bugraq ID: 35755 WordPress是一款流行的blog系统。 WordPress存在输入验证问题，远程攻击者可以利用漏洞获得敏感信息。 WordPress不正确过滤评注作者URLs，当管理员查看时可导致重定向到其他站点而泄漏敏感信息。 WordPress Wordpress B2 0.6.2 .1 WordPress Wordpress B2 0.6.2 WordPress WordPress 2.8.1 WordPress WordPress 2.6.5 WordPress WordPress 2.6.2 WordPress WordPress 2.6.1...

Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit

No description provided by source. / alwaysdirtyneverclean.c AKA Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit alwaysdirtyneverclean.zip BY Jeremy Brown 2009 [email protected] 07.21.2009 I've been up for nearly 24 hours only the last few doing research though. This exploit is base...

Inside Microsoft's July Security Patch Batch

Microsoft released six security bulletins today — three rated Critical and three rated Important. Two of the issues are being actively exploited on the Internet and four of the issues are client-side vulnerabilities, which means the exploit can only occur if a user visits an evil website or opens...

Formatstring vulnerability in smbclient

Description The smbclient utility in Samba 3.2.0 - 3.2.12 contains a formatstring vulnerability where commands dealing with file names treat user input as format strings to asprintf. An example is: smb: \ put aa%3Fbb putting file aa%3Fbb as \aa0,000000bb 0,0 kb/s average 0,0 kb/s As is obvious,...

Directory traversal

Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to list directory contents via a .. dot dot in the dir parameter...

Design/Logic Flaw

admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message...

CVE-2009-2115

admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message...

CVE-2009-2116

CVE-2009-2116 affects SkyBlueCanvas 1.1 r237. A directory traversal vulnerability exists in admin.php where the dir parameter can be manipulated with ".." to list directory contents. Impact per NVD indicates partial confidentiality impact; base CVSS~4.0 (MEDIUM), with network attack vector and au...

CVE-2008-6823

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...

CVE-2008-6823

Multiple cross-site request forgery CSRF vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify the network configuration via certain...

CVE-2009-1464

Multiple cross-site request forgery CSRF vulnerabilities in index.aas in Application Access Server A-A-S 2.0.48 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary programs via a command job, 2 stop services via a setservice job, or 3...

CVE-2009-1512

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php...

Code injection

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php...

CVE-2009-1512

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php...

CVE-2009-1455

Multiple cross-site request forgery CSRF vulnerabilities in WebCollab before 2.50 aka Billy Goat allow remote attackers to hijack the authentication of administrators for requests that change an arbitrary password or have other unspecified impact...

CVE-2009-1456

Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the module parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in WebCollab before 2.50 aka Billy Goat allow remote attackers to hijack the authentication of administrators for requests that change an arbitrary password or have other unspecified impact...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...