833 matches found
PT-2017-6733
Name of the Vulnerable Software and Affected Versions Helpdesk Pro plugin versions prior to 1.4.0 Description The issue allows remote attackers to write to arbitrary .ini files by using a crafted language.save task. Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to...
CVE-2017-14513
Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the ffilename parameter in a fingerprintdo action to admin/app/physical/physical.php...
CVE-2017-14513
MetInfo 5.3.17 contains a directory traversal vulnerability that lets remote attackers read arbitrary INI-format files via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. Exploitation could disclose sensitive data from the server. Affected software/component...
Ubuntu: Security Advisory (USN-3382-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-3382-1 php5, php7.0 vulnerabilities
It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. CVE-2015-8994 It was discovered that the PHP...
USN-3382-1: PHP vulnerabilities
It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. CVE-2015-8994 It was discovered that the PHP...
UBUNTU-CVE-2017-11628
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input...
PHP 5.6.x < 5.6.31 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.31. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists in the PCRE library in the compilebracketmatchingpath function within file pcrejitcompile.c. An...
Internet Bug Bounty: PHP INI Parsing Stack Buffer Overflow Vulnerability
Description: A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop could write 1-byte off a fixed size stack buffer. On...
PHP 'zend_ini_do_op()' function buffer overflow vulnerability
PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A security vulnerability in the 'zendinidoop' function in the Zend/zendiniparser.c file in PHP allows remote attackers to exploit the vulnerability to submit a special...
PT-2017-4178
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.31 PHP versions 7.x prior to 7.0.21 PHP versions 7.1.x prior to 7.1.7 Description A stack-based buffer overflow in the zend ini do op function could cause a denial of service or potentially allow executing code. This...
Wireless IP Camera (P2P) WIFICAM Identity Bypass Vulnerability
Wireless IP Camera P2P WIFICAM is a remote IP camera. A security vulnerability exists in the Wireless IP Camera P2P WIFICAM device that stems from the program failing to properly check the access permissions of the .ini file. An attacker can exploit this vulnerability to bypass authentication...
CVE-2017-8225
On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...
Authentication flaw
On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...
CVE-2017-8225: Insufficiently Protected Credentials
On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...
PT-2017-18227
Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM devices affected versions not specified Description The issue concerns incorrect access control to .ini files, which contain credentials. An attacker can bypass authentication by manipulating the loginuse and...
DLL Hijacking Vulnerability and Information Disclosure Vulnerability in CIMCO Software
CIMCO is the world's leader in DNC solutions and is the world's largest installed base of DNC systems, which are mainly used for networking communication of CNC machine tools, machine tool monitoring, etc. CIMCO DNC-Max Server is the DNC server software. Vulnerability one: CIMCO program default...
SentryHD 02.01.12e - Privilege Escalation Exploit
Exploit for windows platform in category local exploits Exploit Title: SentryHD 02.01.12e Privilege Escalation Date: 18-01-2017 Software Link: http://www.minutemanups.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: local 1...
Arbitrary File Write Vulnerability in FineCMS Backend
FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. An arbitrary file write vulnerability exists in the config/site.ini.php page of the FineCMS backend. Allows attackers to upload webshell and gain server privileges...
Windows Process Filtering System: ProcFilter
Windows Process Filtering System ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with Microsoft’s ETW API , making...