CVE-2013-1427

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

Race condition

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

Debian DSA-2649-1 : lighttpd - fixed socket name in world-writable directory

Stefan Buhler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP contr...

[SECURITY] [DSA 2649-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2649-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2649-1 (lighttpd - fixed socket name in world-writable directory)

Stefan Bühler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP contr...

South Korea HOMPYNET CMS vulnerability-vulnerability warning-the black bar safety net

Upload vulnerability : http://www.xxx.com/admin/imageadmin3.php?boardid=&iname=&iform= http://www.xxx.com/admin/imageadmin2.php?boardid=&iname=&iform= Uploaded posterior diameter: http://www.xxx.com/biswebpage/images/shell.php.en Editor: http://www.xxx.com/admin/editor/SWE.php...

Nmap NSE 6.01: smb-psexec

Implements remote process execution similar to the Sysinternals' psexec tool, allowing a user to run a series of programs on a remote machine and read the output. This is great for gathering information about servers, running the same tool on a range of system, or even installing a backdoor on a...

RedHat Update for dhcp RHSA-2013:0504-02

Check for the Version of dhcp OpenVAS Vulnerability Test RedHat Update for dhcp RHSA-2013:0504-02 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

ASPCMS old version spike get SHELL-vulnerability warning-the black bar safety net

/admin/system/AspCmsSiteSetting. asp? action=saves Direct POST: runMode=1&siteMode=1&siteHelp=%B1%BE%CD%F8%D5%BE%D2%F2%B3%CC%D0%F2%C9%FD%BC%B6%B9%D8%B1%D5%D6%D0&SwitchComments=1&SwitchCommentsStatus=1&switchFaq=0:Y=requestchr3...

Hunt CCTV DVR.cfg Direct Request Information Disclosure

The remote web server appears to be part of a digital video recorder DVR, such as models of Hunt CCTV, that is affected by an information disclosure vulnerability. Specifically, an unauthenticated remote attacker can retrieve the device's configuration file, 'DVR.cfg', which contains sensitive...

Multiple Vulnerabilities in Piwigo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Сross-Site Request Forgery and Path Traversal attacks. 1 Сross-Site Request Forgery CSRF in Piwigo: CVE-2013-1468 The vulnerability exists due to insufficient verificatio...

Nagios XI 2012R1.5b XSS / Command Execution / SQL Injection / CSRF

Nagios XI version 2012R1.5b suffers from cross site request forgery, cross site scripting, remote command injection, and remote SQL injection vulnerabilities. Reflected XSS: Alert Cloud Component: Example URL: http://nagiosxiserver/nagiosxi/includes/components/alertcloud/index.php?width=800";...

Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal

Simple Machine Forum 2.0.x 2.0.4 - File Disclosure Directory Traversal Exploit Title: SMF /index.php?action=admin;area=logs;sa=errorlog;file=BASE64 ENCODED FILE PATH;line=LINE NUMBER Example : /srv/www/smf/Settings.php : L3Nydi93d3cvc21mL1NldHRpbmdzLnBocA= /etc/passwd : L2V0Yy9wYXNzd2Q= SMF...

Nagios XI 2012R1.5b XSS / Command Execution / SQL Injection / CSRF

Reflected XSS: Alert Cloud Component: Example URL: http://nagiosxiserver/nagiosxi/includes/components/alertcloud/index.php?width=800"; alert'xss'; var aa="a" : "b" : " The vulnerable code in Alert Cloud's index.php appears to have been copied and pasted into several other components as well...

ASPCMS old version spike get SHELL-vulnerability warning-the black bar safety net

Old ASPCMS version of the Spike to get SHELL vulnerability Find a background that... Then /admin/system/AspCmsSiteSetting. asp? action=saves Direct POST...

D-Link DCS Cameras Authentication Bypass / Command Execution

D-Link DCS Cameras suffer from authentication bypass and remote command execution vulnerabilities due to a remote information disclosure of the configuration. Unauthenticated remote access to D-Link DCS cameras =================================================== ADVISORY INFORMATION Title:...

Scientific Linux Security Update : net-snmp on SL5.x i386/x86_64 (20130108)

An out-of-bounds buffer read flaw was found in the net-snmp agent. A remote attacker with read privileges to a Management Information Base MIB subtree handled by the 'extend' directive in '/etc/snmp/snmpd.conf' could use this flaw to crash snmpd via a crafted SNMP GET request. CVE-2012-2141 Bug...

Слабая криптография в IP-телефонах Aastra

Configuration file encryption is vulnerable to replay attacks...

Design/Logic Flaw

Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a 1 cache file, 2 password file, or 3 configuration file, or 4 possibly gain privileges by modifying or overwriting a configuration file...

Chromium to 25.0.1343 (important)

Chromium was updated to 25.0.1343 Security Fixes bnc791234 and bnc792154: - CVE-2012-5131: Corrupt rendering in the Apple OSX driver for Intel GPUs - CVE-2012-5133: Use-after-free in SVG filters. - CVE-2012-5130: Out-of-bounds read in Skia - CVE-2012-5132: Browser crash with chunked encoding -...