CVE-2012-5118

Removed by vendor...

PT-2012-5783

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 23.0.1271.64 Description The issue is related to the handling of GPU command buffers, where an integer value is not properly validated. This can be exploited by remote attackers to cause a denial of service or...

PostgreSQL空字符CA SSL整数校验安全绕过漏洞

Bugraq ID: 37334 CVE ID：CVE-2009-4034 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集。 处理部分证书字段中嵌入空字符的SSL证书存在错误，攻击者可以利用漏洞伪造证书，进行中间人等攻击。 SSL证书中的空字符可用于伪造客户端或服务端验证，只影响启用了SSL，执行证书名校验或客户端证书验证，而其CA已经被诱骗发布了非法证书的用户。 PostgreSQL PostgreSQL 8.4.1 PostgreSQL PostgreSQL 8.3.8 PostgreSQL PostgreSQL 8.3.6 PostgreSQL...

webSPELL 4.2.0d (Linux) - Local File Disclosure

/ webSPELL ------------------------------ Possible Fix: $file = pregreplace'/^a-zA-Z0-9/','',addslashes$GET'id'; otherwise if $GET'id' variable is an integer use intval function. $file =...

writersblock-sql.txt

Writer’s Block SQL Injection Vulnerabilities ".$GET'PostID'." AND Draft=0 ORDER BY Timestamp ASC LIMIT 1"; ---- x Exploit The issue can be exploited through a web browser. x Patch Just add an intval: ---- permalink.php, line 212: $getpost = @mysqlquery"SELECT Title, Timestamp, Body, PostCat1,...