Actionpoll 1.1 - 'Actionpoll.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/23504/info Actionpoll is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are als...

Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow

Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow !/usr/bin/python Remote exploit for the 0day Windows DNS RPC service vulnerability as described in https://www.securityfocus.com/bid/23470/info. Tested on Windows 2000 SP4. The exploit if successful binds a shell to TCP port 4444...

Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow

!/usr/bin/python Remote exploit for the 0day Windows DNS RPC service vulnerability as described in https://www.securityfocus.com/bid/23470/info. Tested on Windows 2000 SP4. The exploit if successful binds a shell to TCP port 4444 and then connects to it. Cheers to metasploit for the first exploit...

webMethods Glue 6.5.1 Console - Directory Traversal

webMethods Glue 6.5.1 Console - Directory Traversal source: https://www.securityfocus.com/bid/23423/info webMethods Glue is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary file...

Roxio CinePlayer 3.2 - SonicDVDDashVRNav.dll ActiveX Control Remote Buffer Overflow

Roxio CinePlayer 3.2 - SonicDVDDashVRNav.dll ActiveX Control Remote Buffer Overflow source: https://www.securityfocus.com/bid/23412/info Roxio CinePlayer is prone to a stack-based buffer-overflow vulnerability because it fails to sufficiently check boundaries of user-supplied input before copying...

DropAFew 0.2 - newaccount2.php Arbitrary Account Creation

DropAFew 0.2 - newaccount2.php Arbitrary Account Creation source: https://www.securityfocus.com/bid/23400/info DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could...

DropAFew 0.2 - 'editlogcal.php?save Action calories' SQL Injection

source: https://www.securityfocus.com/bid/23400/info DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

QuizShock 1.6.1 - auth.php HTML Injection

QuizShock 1.6.1 - auth.php HTML Injection source: https://www.securityfocus.com/bid/23368/info QuizShock is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the contex...

PHPwebnews 0.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23448/info The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecti...

Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow

!/bin/sh Exploit for Apache modrewrite off-by-oneWin32. by axis http://www.ph4nt0m.org 2007-04-06 Tested on Apache 2.0.58 Win32 Windows2003 CN SP1 Vulnerable Apache Versions: 1.3 branch: 1.3.28 and 2.0.46 and 2.2.0 and 2006-08-20 http://www.milw0rm.com/exploits/2237 to successfully exploit the...

MERCUR imapd SUBSCRIBE command buffer overflow

Added: 03/27/2007 CVE: CVE-2007-1579 BID: 23050 OSVDB: 33546 Background MERCUR Messaging Server is an e-mail server supporting the SMTP, POP3, and IMAP protocols for Windows platforms. Problem A buffer overflow vulnerability allows remote, authenticated attackers to execute arbitrary commands by...

Mercury Mail 4.0.1 (LOGIN) Remote IMAP Stack Buffer Overflow Expl

Exploit for unknown platform in category remote exploits ==================================================================== Mercury Mail 4.0.1 LOGIN Remote IMAP Stack Buffer Overflow Exploit ==================================================================== !/usr/bin/perl...

Free File Hosting System 1.1 - 'register.php?AD_BODY_TEMP' Remote File Inclusion

source: https://www.securityfocus.com/bid/23118/info Free File Hosting is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; othe...

Mercury/32 Mail Server 4.0.1 - 'LOGIN' Remote IMAP Stack Buffer Overflow

!/usr/bin/perl https://www.securityfocus.com/bid/11775 credit to Muts for this vulnerability acaro at jervus.it use IO::Socket::INET; use Switch; if @ARGV 3 print "--------------------------------------------------------------------\n"; print "Usage : mercury-4444-multi.pl -hTargetIPAddress...

Microsoft Windows Vista - Windows Mail Local File Execution

source: https://www.securityfocus.com/bid/23103/info Microsoft Windows Vista Windows Mail is prone to a local file-execution vulnerability due to a design error. An attackers may exploit this issue to execute local files. The attacker must entice a victim into opening a maliciously crafted link...

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2)

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow PoC 2 source: https://www.securityfocus.com/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it...

PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection

source: https://www.securityfocus.com/bid/23033/info PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitra...

Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service

source: https://www.securityfocus.com/bid/22977/info Symantec 'SYMTDI.SYS' device driver is prone to a local denial-of-service vulnerability. A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users. This issue is similar to the one...

Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion

source: https://www.securityfocus.com/bid/22985/info Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application. A successful attack can reduce the integrity of affected computers and may aid in...

softnews-rfi.txt

By Hasadya Raed Contact : [email protected] ------------------------------------ Script : SoftNews Media Group Dork : "Copyright © 2004,2006 SoftNews Media Group" Greetz : Only To Security Focus ------------------------------------ B.Files : init.php editnews.php ----------------------------------...