Kaspersky Secure Mail Gateway Configuration File Injection Vulnerability

Kaspersky Secure Mail Gateway is an email security solution from Russia's Kaspersky Lab. The program is able to automatically filter spam, phishing sites and various malicious attachments. A security vulnerability exists in Kaspersky Secure Mail Gateway version 1.1. An attacker can exploit the...

DEBIAN-CVE-2017-15093

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

UBUNTU-CVE-2017-15093

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

CVE-2017-15093

CVE-2017-15093 affects PowerDNS Recursor (4.x up to 4.0.6 and 3.x up to 3.7.4). An authenticated user can modify the Recursor’s ACL by adding/removing netmasks and configure forward zones when api-config-dir is non-empty. The root cause is insufficient validation of the new netmask and IP address...

CVE-2017-5187

A Cross-Site Request Forgery CWE-352 vulnerability in Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to...

realmd: untrusted data is used when configuring sssd.conf and/or smb.conf

A flaw was found in the way realmd parsed certain input when writing configuration into the sssd.conf or smb.conf file. A remote attacker could use this flaw to inject arbitrary configurations into these files via a newline character in an LDAP response...

CVE-2015-2704

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response...

PHP4DVD 2.0 Code Injection

Exploit Title : PHP4DVD PHP Code Injection Date : 31 May 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://php4dvd.sourceforge.net/ Software Link : http://downloads.sourceforge.net/project/php4dvd/php4dvd-2.0.zip Version : 2.0 Tested on : Window and Linux...

Nagios XI多个远程安全漏洞

Bugtraq ID:57672 Nagios是一款免费开放源代码的主机和服务监视软件 Nagios存在多个安全漏洞，包括： -Alert Cloud组件存在反射型跨站脚本漏洞，可获得敏感信息或劫持用户会话。 -Nagios QL存在存储型跨站脚本漏洞，可获得敏感信息或劫持用户会话。 -Autodiscovery没有正确过滤输入，允许攻击者提交恶意作业执行任意代码。 -'admin/commandline.php'脚本不正确过滤用户提交的参数，允许攻击者利用漏洞注入任意SQL。 -Nagios QL存在跨站请求伪造漏洞，允许攻击者利用漏洞执行恶意操作。...

Serendipity < 1.5.3 'Xinha WYSIWYG' Editor Security Bypass Vulnerability

Serendipity is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:s9y:serendipity";...

MigasCMS Xinha Configuration Injection

================================================ migascms "Xinha" Plugin Configuration Injection Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1...

MOPS-2010-020: Xinha WYSIWYG Plugin Configuration Injection Vulnerability

MOPS-2010-020: Xinha WYSIWYG Plugin Configuration Injection Vulnerability May 10th, 2010 A preauth plugin configuration injection vulnerability was discovered in the WYSIWYG editor Xinha that allows e.g. uploading arbitrary PHP files to the webserver. Affected versions Affected is Xinha = 0.96 Be...

Golabi CMS &lt;= 1.0.1 Session Poisoning Vulnerability

No description provided by source. -------------------------------------------------------------------------------- \ \ / \ | | / \ /\ \ \ \ | |/ /\ \ / \ / / | | \ | | // / / \ / | \ | / // /| | \ /|| / / | /| /\ / \ / / / // / /// /...

CVE-2006-5137

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to 1 inject PHP code via a theme array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; 2 inject PHP code via a config array parameter to...