Stack overflow

Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control HyleosChemView.ocx in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the 1 SaveasMolFile and 2 ReadMolFile...

CVE-2010-0679

Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control HyleosChemView.ocx in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the 1 SaveasMolFile and 2 ReadMolFile...

Design/Logic Flaw

Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...

CVE-2010-0642

Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...

Radasm v2.2.1.6 .rap file Local Buffer Overflow PoC

Exploit for unknown platform in category dos / poc ==================================================== Radasm v2.2.1.6 .rap file Local Buffer Overflow PoC ==================================================== /Radasm .rap file local buffer overflow POC I'll be back in a few hours with the exploit...

RadASM 2.2.1.6 - .rap Local Buffer Overflow (PoC)

RadASM 2.2.1.6 - .rap Local Buffer Overflow PoC /Radasm .rap file local buffer overflow POC I'll be back in a few hours with the exploit. The vuln is in the filename field. snip Files...1=AVP OVERFLOW... snip / include void genrandomchar,const int; void printchar; unsigned int getFsizeFILE,char;...

[CORE-2010-0121] Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Servers 1. Advisory Information Title: Multiple Vulnerabilities with 8.3 Filename Pseudonyms in Web Serve...

CVE-2009-4015

Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments...

CVE-2009-4015

Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments...

CVE-2009-2902

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename...

CVE-2009-2902

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename...

PT-2010-1277 · Apache +2 · Apache Tomcat +2

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 5.5.0 through 5.5.28 Apache Tomcat versions 6.0.0 through 6.0.20 Description: The issue allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename. When deploying WAR file...

Stack overflow

Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter...

phpMyAdmin创建不安全文件和目录漏洞

BUGTRAQ ID: 37826 CVE ID: CVE-2008-7251,CVE-2008-7252 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin在创建临时目录时使用了完全可写的权限，在创建临时文件时使用了可预测的文件名。本地或远程攻击者可以非授权修改文件，或通过符号链接攻击获得权限提升。 phpMyAdmin 2.11.x 厂商补丁： phpMyAdmin ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Code injection

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename...

CVE-2010-0002

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename...

CVE-2010-0002

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename...

Fedora 12 : gcc-4.4.2-20.fc12 (2009-12813)

Tue Dec 22 2009 Jakub Jelinek 4.4.2-20 - fix MEMSIZE of reload created stack slots 548825, PR rtl-optimization/42429 - fix addition of one character long filenames in fastjar 549493 - Thu Dec 17 2009 Jakub Jelinek 4.4.2-18 - update from gcc-44-branch - PRs c++/42387 - another C++ virtual dtors...

Mozilla Firefox

The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows?remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly...

Design/Logic Flaw

Microsoft Internet Information Services IIS, when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : colon and a safe extension, as demonstrate...