888 matches found
CVE-2009-3949
cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and confpassword parameters...
CVE-2009-3949
CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier (cp/profile.php). The root cause is missing administrative authentication for the donewauthor action, allowing remote attackers to create administrative accounts via the name, password, and conf_password parameters. Exploitation is net...
Directory traversal
Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the optionsstyledir parameter to the default URI...
Sql injection
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field...
CVE-2009-3212
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field...
CVE-2009-3212
The CVE-2009-3212 entry describes an SQL injection in VivaPrograms Infinity Script 2.x.x when magic_quotes_gpc is disabled. The underlying issue is improper sanitization/escaping of the username field, enabling remote attackers to craft inputs that alter SQL queries. Impact is described as arbitr...
CVE-2009-3211
Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the optionsstyledir parameter to the default URI...
CVE-2009-3211
CVE-2009-3211 describes a directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x. When magic_quotes_gpc is disabled, remote attackers can read arbitrary files by injecting a .. into the options[style_dir] parameter of the default URI. The NVD entry lists a base score of 6.8 (Medi...
CVE-2009-3212
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field...
Infinity <= v2.X.X (Local File Disclosure/Auth Bypass) Vulnerabilities
-----------------Infinity = v2.X.X Local File Disclosure/Auth Bypass Vulnerabilities------------------------- Script : Infinity version : 2.X.X Language: PHP Site: http://www.dimofinf.net/ Author: SwEET-DeViL need magicquotesgpc = Off -----...
Infinity 2.x - options[style_dir] Local File Disclosure
Infinity 2.x - optionsstyledir Local File Disclosure ------------------Infinity ---------------------------------------------------------------------------------------------------------------- - +LFD Exploit: http://WWW.Site.Com/inf/?optionsstyledir=../include/db.php%00...
Infinity <= 2.x.x options[style_dir] Local File Disclosure Vulnerability
Exploit for unknown platform in category web applications ======================================================================== Infinity ---------------------------------------------------------------------------------------------------------------- - +LFD Exploit:...
Infinity 2.x.x Local File Disclosure
------------------Infinity ---------------------------------------------------------------------------------------------------------------- - +LFD Exploit: http://WWW.Site.Com/inf/?optionsstyledir=../include/db.php%00 http://WWW.Site.Com/inf/?optionsstyledir=../../../../../../etc/passwd%00...
Infinity <= 2.x.x options[style_dir] Local File Disclosure Vulnerability
No description provided by source. ------------------Infinity = v2.X.X Local File Disclosure / Auth Bypass Vulnerabilities------------------------- ---------------------------------------------------------------------------------------------------------------- Script : Infinity version : 2.X.X...
Infinity 2.x - 'options[style_dir]' Local File Disclosure
------------------Infinity ---------------------------------------------------------------------------------------------------------------- - +LFD Exploit: http://WWW.Site.Com/inf/?optionsstyledir=../include/db.php%00 http://WWW.Site.Com/inf/?optionsstyledir=../../../../../../etc/passwd%00...
Microsoft GDI Plugin - .png Infinite Loop Denial of Service (PoC)
Microsoft GDI Plugin - .png Infinite Loop Denial of Service PoC ! /usr/bin/perl CALgdiplugpoc.pl MircosoftgdiplugpnginfinityloopD.o.S POC by Code Audit Labs public 2009-04-17 http://www.vulnhunt.com/ Affected ======== test on full updated winxp sp3 other version should be affected CVE: please...
Microsoft GDI Plugin .png Infinite Loop Denial of Service PoC
Exploit for unknown platform in category dos / poc ============================================================= Microsoft GDI Plugin .png Infinite Loop Denial of Service PoC ============================================================= ! /usr/bin/perl CALgdiplugpoc.pl...
Double Denial of Service in Call of Duty 4 1.6
Luigi Auriemma Application: Call of Duty 4: Modern Warfare http://www.callofduty.com Versions: = 1.6 Platforms: Windows tested and Linux Bugs: A "Attempted to overrun string in call to va" DoS B "callvote map" Denial of Service Exploitation: remote, versus server in-game Date: 22 Jun 2008 Author:...
游戏使命召唤畸形stats命令拒绝服务漏洞
BUGTRAQ ID: 29026 使命召唤（Call of Duty）是Infinity Ward开发的非常流行的第一人称扮演游戏。 使命召唤在处理畸形格式的请求数据时存在漏洞，远程攻击者可能利用此漏洞导致服务器不可用。 使命召唤4引入了一类被称为stats的无连接命令，玩家加入远程游戏后就会顺序发送0到6类型的上述命令。服务器还接收额外的7类型stats命令，如果客户端使用了这个7类型命令的话，远程服务器就会由于负数大小值的memcpy而崩溃。 成功利用这个漏洞要求攻击者知道受保护服务器的口令，此外如果服务器要求的话还需要拥有有效的cdkey。 Activision Call of...
http://marmarahosting.org/infinity.txt
"Infinity Solutions LLC" e/description.asp sql injection Credit : CodeXpLoder'tq mail : codexploderathotmaildotcom site : Biyosecurity.net,expw0rm.com thx : BiyoSecurityTeam spec.note : "Live The Life" 1- example.com/patch/description.asp?id=sql methot 1- example.com/e/description.asp?id=sql meth...