CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-0770

Cross-site scripting XSS vulnerability in Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 allows remote attackers to inject arbitrary web script or HTML via the Windows XP variable in a file...

W78CMS v2. 7. 6 search type injection problems and repair solutions-vulnerability warning-the black bar safety net

Brief description: W78CMS enterprise website management system v2. 7. 6 UTF-8 the presence of search-type injection problems Detailed description: File so. asp 2 2 row % t=request. QueryString"t" key=request. QueryString"key" if t="" then Response. Write"scriptalert'please select to search the...

Rails 3.0.5 Log File Injection Proof Of Concept

Encoding: UTF-8 Log-File-Injection - Ruby on Rails 3.05 possibilities: - possible date back attacks tried with request-log-analyzer: worked but teasercheckwarnings - ip spoofing - binary log-injections - DOS if ip is used with an iptables-ban-script !! works only on intranet apps !! Fix: validate...

DEBIAN-CVE-2009-5053

Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file...

Hua-the local portal system(port) 5.0 XDAY-vulnerability warning-the black bar safety net

Look at the background of the login authentication file: File code:admin/index. asp %dbs="../"% !-- include file="../inc/config. asp" - !-- include file="../inc/md5. asp" - % if session"adminid""" and session"adminuser""" Then response. Redirect "main. asp" response. End end if action=request...

CVE-2003-1577

CVE-2003-1577 affects Sun ONE/iPlanet Web Server 4.1–SP12 and 6.0–SP5 when DNS resolution is enabled for client IPs. A crafted DNS response can be combined with an HTTP request to inject arbitrary text into server logs and trigger cross-site scripting (XSS) in the iPlanet Log Analyzer, via an Inv...

Changetrack 4.3-3 Local Privilege Escalation Vulnerability

Exploit for linux platform in category local exploits ========================================================== Changetrack 4.3-3 Local Privilege Escalation Vulnerability ========================================================== TITLE: Changetrack Privilege Escalation Vulnerability SECUNIA...

Campsite 'g_campsiteDir' Remote and Local File Inclusion Vulnerabilities

This host is running Campsite and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodcampsitemultvuln.nasl 5055 2017-01-20 14:08:39Z teissa $ Campsite 'gcampsiteDir' Remote and Local File Inclusion Vulnerabilities Authors: Sharath S Copyright: Copyright c 2009 SecPod,...

Flexcustomer 0.0.6 - Admin Authentication Bypass Possible PHP Code Writing

Flexcustomer 0.0.6 - Admin Authentication Bypass Possible PHP Code Writing START 0x01 Informations: Script : Flexcustomer Download : http://www.hotscripts.com/jump.php?listingid=25331&jumptype=1 Vulnerability : Admin Login Bypass / Possible PHP code writing Author : Osirys Contact :...

gemini-rfi.txt

The Gemini Portal Multiple Remote File inj. version: 4.7 ---------------------------------------------------------- Discovered By: ZoRLu Date: 26.09.2008 Home: www.z0rlu.blogspot.com contact: [email protected] contact: [email protected] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...! N0T: YALNIZLIK,...

Gentoo Security Advisory GLSA 200609-12 (mailman)

The remote host is missing updates announced in advisory GLSA 200609-12. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200609-12 (mailman)

The remote host is missing updates announced in advisory GLSA 200609-12. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

fileutility.txt

module Msf class Auxiliary::Spoof::Kyocera::FileUtility 'Kyocera Mita File Utility File Injection', 'Description' = %q This exploit attacks the Kyocera Mita File Utility 3.3.0.1 that is part of a scan to desktop solution. There are several bugs in this service. First, there is no authentication...

Kyocera Mita Scanner File Utility 3.3.0.1 - File Transfer Directory Traversal

source: https://www.securityfocus.com/bid/30855/info Kyocera Mita Scanner File Utility is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied input. Attackers can exploit this issue to create and overwrite arbitrary files on the affected computer...

Kyocera Mita Scanner File Utility 3.3.0.1 - File Transfer Directory Traversal

Kyocera Mita Scanner File Utility 3.3.0.1 - File Transfer Directory Traversal source: https://www.securityfocus.com/bid/30855/info Kyocera Mita Scanner File Utility is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied input. Attackers can exploit...

PT-2007-3271

Name of the Vulnerable Software and Affected Versions DirectAdmin versions prior to 1.293 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via http or ftp requests logged in various log files, including /var/log/directadmin/security.log. It also enabl...

sBLOG 0.7.3 Beta (inc/lang.php) Local File Inclusion Exploit

No description provided by source. !/usr/bin/perl sBLOG 0.7.3 Betainc/lang.phpLocal File Inclusion Exploit D.Script: http://sourceforge.net/projects/sblog/ V.Code: ifisset$conflangdefault && fileexists'lang/' . $conflangdefault . '.php' require'lang/' . $conflangdefault . '.php'; Discovered...

edittag12-xss.txt

Script: EditTag Version: 1.2 Author: Greg Billock [email protected] Discoverer: NetJackal nima5014TyAhooD0Tcom - nj4ThackerzD0Tir I am sorry for my BAD English. Description: 1 Local file injection: An attacker can use edittag.cgi or edittagmp.cgi maybe .pl to inject files ex. /etc/passwd...

Multiple bugs in EditTag

Script: EditTag Version: 1.2 Author: Greg Billock [email protected] Discoverer: NetJackal nima5014TyAhooD0Tcom - nj4ThackerzD0Tir I am sorry for my BAD English. Description: 1 Local file injection: An attacker can use edittag.cgi or edittagmp.cgi maybe .pl to inject files ex. /etc/passwd...