698 matches found
b2ePMS 1.0 SQL Injection
Title: b2ePMS 1.0 multiple SQLi Vulnerabilities Version: 1.0 Author/Found by: loneferret Manifacturer/Software link: https://developer.berlios.de/projects/b2epms/ Other vulnerability: http://www.exploit-db.com/exploits/18882/ Date found: May 27th 2012 Tested on: Ubuntu Server 8.04 / PHP Version...
Skype 5.8x 5.5x - Corruption & Persistent Vulnerability
Document Title: =============== Skype 5.8x 5.5x - Corruption & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=455 MRSC ID: 12250 Video: http://vulnerability-lab.com/getcontent.php?id=457 Release Date: ============= 2012-03-27...
Cyberoam Central Console 2.00.2 - Remote File Inclusion
Cyberoam Central Console 2.00.2 - Remote File Inclusion Title: ====== Cyberoam Central Console v2.00.2 - File Include Vulnerability Date: ===== 2012-02-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=405 VL-ID: ===== 405 Introduction: ============= Cyberoam Central...
PHPCMS 9 index.php 本地文件包含漏洞
phpcms/modules/search/index.php 代码如下： public function publicgetsuggestkeyword $url = $GET'url'.'&q='.$GET'q'; $res = @filegetcontents$url; ifCHARSET != 'gbk' $res = iconv'gbk', CHARSET, $res; echo $res;...
CVE-2011-4768
The Site Editor aka SiteBuilder feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...
CVE-2011-4761
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilderedit.php and certain other files. NOTE: it is...
CVE-2011-4743
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files...
Design/Logic Flaw
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files...
Design/Logic Flaw
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilderedit.php and certain other files. NOTE: it is...
Design/Logic Flaw
The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...
CVE-2011-4761
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilderedit.php and certain other files. NOTE: it is...
CVE-2011-4732
The CVE-2011-4732 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18. The issue is that the Server Administration Panel omits the Content-Type header's charset parameter for certain resources, which may enable remote attackers to cause an unspecified impact via an interpretation confl...
CVE-2011-4855
The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...
CVE-2011-4761
The CVE-2011-4761 entry concerns Parallels Plesk Small Business Panel 10.2.0, where the Content-Type header omits the charset parameter for certain resources (notably involving domains/sitebuilder_edit.php). This omission could allow remote attackers to achieve an unspecified impact via an interp...
Toko Lite CMS 1.5.2 - HTTP Response Splitting / Cross-Site Scripting
source: https://www.securityfocus.com/bid/49673/info Toko LiteCMS is prone to an HTTP-response-splitting vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script cod...
phpcms2008 & phpcms2007 GBK版ask/search_ajax.php SQL注射漏洞
PHPCMS 是国内领先的网站管理系统，同时也是一个开源的PHP开发框架 漏洞文件：ask/searchajax.php code： ?php require './include/common.inc.php'; requireonce MODROOT.'include/ask.class.php'; $ask = new ask; header'Content-type: text/html; charset=utf-8'; ifstrtolowerCHARSET != 'utf-8' $q = iconvCHARSET, 'utf-8', $q; if$q $where = "...
Zend Framework "PDO_MySql"安全限制绕过漏洞
BUGTRAQ ID: 47919 Zend Framework ZF 是一个开放源代码的 PHP5 开发框架，可用于来开发 web 程序和服务。 Zend Framework在实现上存在"PDOMySql"安全限制绕过漏洞，远程攻击者可利用此漏洞绕过某些安全限制，利用SQL注入漏洞。 Zend Zend Framework 1.11.4 Zend Zend Framework 1.11.3 Zend Zend Framework 1.10.4 Zend Zend Framework 1.10.3 Zend Zend Framework 1.10.2 厂商补丁： Zend ----...
DEBIAN-CVE-2010-4767
Open Ticket Request System OTRS before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service duplicate tickets and duplicate auto-response...
CVE-2010-4767
Open Ticket Request System OTRS before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service duplicate tickets and duplicate auto-response...
