Altirix eXpress NS SC Download ActiveX控件任意文件下载漏洞

Bugraq ID: 36346 Altirix eXpress NS SC Download ActiveX是一款下载管理控件。 Altirix eXpress NS SC Download ActiveX控件不正确处理下载方法，远程攻击者可以利用漏洞下载并执行任意程序。 Altiris.AeXNSPkgDL.1 ActiveX"AeXNSPkgDLLib.dll"控件提供的"DownloadAndInstall"方法不安全，构建恶意的WEB页，诱使用户打开，可导致以登录用户安全上下文执行任意程序。 Symantec Deployment Solution 6.9 SP3 Symant...

CVE-2008-7163

Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the sineconfigindexmain parameter...

Firefox 3.5.x < 3.5.2 Multiple Vulnerabilities

The installed version of Firefox 3.5 is earlier than 3.5.2. Such versions are potentially affected by the following security issues : - A SOCKS5 proxy that replies with a hostname containing more than 15 characters can corrupt the subsequent data stream. This can lead to a denial of service, thou...

Compface '.xbm'文件缓冲区溢出漏洞

Bugraq ID: 35863 CVE ID：CVE-2009-2286 Compface是一款X-face格式转换的工具和库。 Compface处理'.xbm'文件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 构建包含超长条目的'.xbm'文件，诱使用户解析，可导致任意代码执行。 MandrakeSoft Enterprise Server 5 x8664 MandrakeSoft Enterprise Server 5 James Ashton compface 1.5.2 Debian Linux 5.0 sparc Debian Linux 5.0 s/3...

CVE-2008-6878

Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the SESSIONlanguage parameter. NOTE: the vendor disputes this...

CVE-2008-6877

Summary: CVE-2008-6877 affects Zen Cart 1.3.8 and 1.3.8a. A directory traversal flaw exists in admin/includes/initsystem.php when .htaccess is not supported, allowing remote attackers to include and execute arbitrary local files via a ".." in the loader_file parameter. The vendor disputes the sev...

CVE-2009-2444

The CVE-2009-2444 vulnerability affects ADbNewsSender and allows directory traversal through path_to_lang in setup/index.php, enabling remote inclusion and execution of local files. Affected versions are ADbNewsSender before 1.5.6 and 2.0 before RC2. The CVSS2 base score is 7.5 (HIGH) with NETWOR...

Ubuntu 9.04 : moodle vulnerability (USN-791-2)

Christian Eibl discovered that the TeX filter in Moodle allowed any function to be used. An authenticated remote attacker could post a specially crafted TeX formula to execute arbitrary TeX functions, potentially reading any file accessible to the web server user, leading to a loss of privacy...

USN-791-2: Moodle vulnerability

Christian Eibl discovered that the TeX filter in Moodle allowed any function to be used. An authenticated remote attacker could post a specially crafted TeX formula to execute arbitrary TeX functions, potentially reading any file accessible to the web server user, leading to a loss of privacy...

CVE-2009-1912

CVE-2009-1912 affects webSPELL 4.2.0e and earlier. A directory traversal flaw in src/func/language.php lets remote attackers craft a language cookie containing .. to include and execute arbitrary local PHP files; exploitation can progress to SQL injection by including awards.php. The NVD/NVD-deri...

CVE-2009-1774

Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal...

CVE-2009-1662

Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 Password fields, as reachable from admin/index.php...

NotFTP 'config.php' Local File Include Vulnerability

NotFTP is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks. NotFTP 1.3.1 is vulnerabl...

OneOrZero Helpdesk 'login.php' Local File Include Vulnerability

OneOrZero Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks. OneOrZero...

Update Protection against Akamai Download Manager Arbitrary Program Execution

In its Update Rollup for ActiveX Kill Bits from February 2009 960715, Microsoft has released a security update to set a kill bit for an ActiveX control developed by Akamai Technologies. Akamai Technologies has released a security update that addresses a vulnerability in the affected...

Directory traversal

Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 gatewaymodule parameter to plugin/gateway/gnokii/init.php and the 2 themesmodule parameter to plugin/themes/default/init.php...

PrestaShop 1.1 - order.php?PATH_INFO Cross-Site Scripting

PrestaShop 1.1 - order.php?PATHINFO Cross-Site Scripting source: https://www.securityfocus.com/bid/32689/info PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

IIS vulnerability application-vulnerability warning-the black bar safety net

by yuange The newly discovered IIS a bunch of vulnerabilities, and talk about the application. Need a virtual executable Directory,WINDOWS common /scripts,/cgi-bin,/vtibin, General/vtibin directory is mapped to the“program files”directory, usually in the system tray above, and the SCRIPTS sometim...

CVE-2008-5015

CVE-2008-5015 affects Mozilla Firefox 3.x prior to 3.0.4. The issue arises when a file: URI is accessed in the same tab as a chrome or privileged about: page, allowing a user-assisted attacker to run arbitrary JavaScript with chrome privileges via code saved locally. The underlying vulnerability ...

Free Articles Directory RFI Vulnerability

Free Articles Directory is prone to a remote file include RFI vulnerability. SPDX-FileCopyrightText: 2008 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...