Openfire多个输入验证漏洞

BUGTRAQ ID: 32189 Openfire（原名为Wildfire）是一个采用Java开发的跨平台开源实时协作（RTC）服务器。 Openfire服务器中的多个安全漏洞可能允许攻击者在操作系统上执行任意代码，具体取决于特定的运行时环境。 1 绕过认证 在对openfire管理接口的认证中，Tomcat应用服务器中的过滤器org.jivesoftware.admin.AuthCheckFilter确保仅有通过认证的用户才可以访问管理接口，否则将会被重新定向到登录页面。Openfire中的一个错误可能导致无需管理用户凭据便访问内部功能。...

Ignite Gallery Component for Joomla! 'gallery' Parameter SQLi

The version of the Ignite Gallery component for Joomla! running on the remote host is affected by a SQL injection vulnerability in ignitegallery.php due to improper sanitization of user-supplied input to the 'gallery' parameter before using it to construct database queries. Regardless of the PHP...

Joomla Ignite Gallery 0.8.3 SQL Injection

Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: Valon Kerolli Contact: valonatitshqip.com Site: www.itshqip.com ScriptName: "Joomla" Component: "Ignite Gallery comignitegallery" Version: "0.8.3" Author: "Matt Thomson" Author E-mail:...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla"...

Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability ================================================================= Joomla Component Ignite Gallery SQL...

Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability

No description provided by source. Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla" Component: "Ignite Galler...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla" Component: "Ignite Gallery comignitegallery" Version: "0.8.3...

CVE-2008-1728

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service daemon outage by triggering large outgoing queues without reading messages...

CVE-2008-1728

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service daemon outage by triggering large outgoing queues without reading messages...

CVE-2008-1728

CVE-2008-1728 : The Ignite Realtime Openfire 3.4.5 open-source Jabber server is affected via ConnectionManagerImpl.java, where remote authenticated users can trigger large outgoing queues without reading messages, causing a denial of service (daemon outage). The NVD entry lists a base CVSS v2 sco...

Command injection

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

CVE-2007-4590

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

CVE-2007-4590

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

CVE-2007-4590

CVE-2007-4590 affects HP-UX environments where Ignite-UX (C.7.0–C.7.3) and DynRootDisk (DRD) (A.1.0.16.417–A.2.0.0.592) are used. The get_system_info command on HP-UX B.11.11/11.23/11.31 does not inform local users of networking changes it makes, with impact and attack vectors not clearly defined...

HP-UX get_system_info工具非授权更改配置漏洞

HP-UX是一款HP公司开发的UNIX操作系统。 Ignite-UX和DynRootDisk系统的getsysteminfo工具实现上存在漏洞，本地攻击者可能利用此漏洞非授权更改系统网络参数。 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.00 HP已经为此发布了一个安全公告（HPSBUX02249）以及相应补丁: HPSBUX02249：SSRT071442 rev.1 HP-UX Running the Ignite-UX or the DynRootDisk DRD getsysteminfo Command, Local...

HP-UX get_system_info privilege escalation

It's possible to change system configuration with getsysteminfo if Ignite-UX or the DynRootDisk DRD are installed...

HPSBUX02249 SSRT071442 rev.1 HP-UX Running the Ignite-UX or the DynRootDisk (DRD) get_system_info Command, Local Unqualified Configuration Change

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01118367 Version: 1 HPSBUX02249 SSRT071442 rev.1 HP-UX Running the Ignite-UX or the DynRootDisk DRD getsysteminfo Command, Local Unqualified Configuration Change NOTICE: The information in this...

Ignite Realtime Openfire未明特权提升漏洞

Ignite Realtime Openfire是一款实时协作服务程序。 Ignite Realtime Openfire存在多个问题，远程攻击者可以利用漏洞提升特权。 漏洞允许恶意用户通过内置的管理控制台上传代码到Openfire而执行任意指令。目前没有详细漏洞细节提供。 Ignite Realtime Openfire 3.3 升级程序： Ignite Realtime Openfire 3.3 Ignite Realtime openfire-3.3.1-1.i386.rpm...

Design/Logic Flaw

The admin console in Ignite Realtime Openfire 3.3.0 and earlier formerly Wildfire does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the...

CVE-2007-2975

The admin console in Ignite Realtime Openfire 3.3.0 and earlier formerly Wildfire does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the...