Mozilla SeaMonkey < 2.0 Multiple Vulnerabilities

Binary data 801372.prm...

Critical: Red Hat Security Advisory: seamonkey security update

Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat...

Download filename spoofing with RTL override — Mozilla

Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character RTL in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this...

Horde跨站脚本和文件覆盖漏洞

BUGTRAQ ID: 36382 Horde Framework是个以PHP为基础的架构，用于创建网络应用程序。 Horde应用框架中存在多个输入验证错误，远程攻击者可以通过向服务器提交恶意请求执行脚本注入或跨站脚本攻击。 1 表单库在处理图形表单字段时可能导致覆盖任意本地文件。成功攻击要求应用使用了受影响的图形字段（如Ansel或Turba）且拥有写权限。 2 MIME Viewer库在渲染某些文本部分时存在错误，用户查看恶意数据时就会导致在浏览器会话中执行任意HTML和脚本代码。 3 偏好系统没有正确地过滤数字的偏好类型，可能导致在浏览器会话中执行任意HTML和脚本代码。 Hord...

Mandriva Linux Security Advisory : samba (MDVSA-2009:196)

Multiple vulnerabilities has been found and corrected in samba : Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename CVE-2009-1886. The...

PCI DSS compliance : options settings

This plugin reports the values of a few important scan settings if PCI DSS compliance checks are enabled. These scan settings are preset based on the scan template you have selected, but in some cases may be overriden. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

Mandrake Security Advisory MDVSA-2009:124-1 (apache)

The remote host is missing an update to apache announced via advisory MDVSA-2009:124-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

织梦(DedeCms) V 5.3 任意变量覆盖漏洞

看核心文件include/common.inc.php中的代码 //检查和注册外部提交的变量 foreach$REQUEST as $k=$v if strlen$k0 && eregi'^|cfg|GLOBALS',$k && !isset$COOKIE$k //程序员逻辑混乱了？ exit'Request var not allow!'; 这个地方可以通过提交COOKIE变量绕过cfg等关键字的过滤 接着是注册变量的代码 foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k = $v $$k =...

the iframe of the anti-plug-crack-vulnerability warning-the black bar safety net

Author: emptiness prodigal heart See Monyer of the article: the iframe of the anti-Plug and plug-on http://hi.baidu.com/monyer/blog/item/108c718d9aedcf15b21bba56.html The code is as follows: the window. onload = function iftop!= self var f = document. createElement"form"; f. action=location; f...

Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite

Digital Security Research Group DSecRG Advisory DSECRG-09-006 http://www.dsecrg.com/pages/vul/show.php?id=62 Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL: http://synactis.com Bugs: Null byte File overwriting Exploits: YES Reported: 15.01.2009 Vendor response: NONE...

Easy Grid ActiveX控件任意文件覆盖漏洞

BUGTRAQ ID: 33272 Easy Grid ActiveX控件是用于打印、预览表格、图标、公式、表达式的工具。 EasyGrid.SGCtrl.32 ActiveX控件（EasyGrid.ocx）没有安全地调用DoSaveFile方式，如果用户受骗访问了恶意网页并向该方式传送了特制参数的话，就会导致向用户系统写入任意文件。 Easy Grid Control Team Easy Grid ActiveX 3.51 厂商补丁： Easy Grid Control Team ----------------------...

Discuz! 6.x/7.x $_DCACHE数组变量覆盖漏洞 Check

No description provided by source. !/bin/bash Discuz! 6.x/7.x SODB-2008-13 Check By heihei@安全小站群 文件中googlepagecount参数是 google搜索结果的页数，大于0就可以，太大了，google会认为是自动机而停止处理！ 开启WAP注册的结果URL列表保存在当前目录下urllist 修正 cnb|rd@SEBUG 需要自己修改countPage，因为googlepagecount多了google就以为是病毒呢 countPage=10 flag=0 while "$flag" -lt...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

GLSA-200811-01 : Opera: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200811-01 Opera: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Opera: Opera does not restrict the ability of a framed web page to change the address associated with a different frame CVE-2008-4195. Chri...

phpMyAdmin Import_Blacklist变量覆盖漏洞

BugCVE: CVE-2005-4079 BUGTRAQ: 15761 phpMyAdmin对某些变量的处理上存在漏洞，远程攻击者可能利用此漏洞在主机上执行任意命令。 phpMyAdmin将不应该被registerglobals仿真层覆盖的变量黑名单存储在全局变量中，但却没有包含$importblacklist变量名，因此攻击者可以覆盖该变量。如果覆盖了该变量的话，攻击者就可以用任意内容覆盖$GLOBALS数组，导致执行任意代码。 phpMyAdmin phpMyAdmin 2.7/2.7.0 beta1 phpMyAdmin ----------...

WWWBoard覆盖任意消息漏洞

BugCVE: CVE-1999-0930 BUGTRAQ: 1795 wwwboard.pl是Matt Wright写的一个perl脚本，用来处理web留言板。wwwboard.pl脚本存在一个问题，在用户使用form method=POST提交时没有检查其提交内容。input type=hidden name= followup value=栏的 followup 是相关的前一个消息，如果恶意用户修改了 followup 的值将导致以前存在的留言被覆盖。 2.0 Alpha 2 Matt Wright -----------...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...