httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

Mandrake Security Advisory MDVSA-2009:124-1 (apache)

The remote host is missing an update to apache announced via advisory MDVSA-2009:124-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

织梦(DedeCms) V 5.3 任意变量覆盖漏洞

看核心文件include/common.inc.php中的代码 //检查和注册外部提交的变量 foreach$REQUEST as $k=$v if strlen$k0 && eregi'^|cfg|GLOBALS',$k && !isset$COOKIE$k //程序员逻辑混乱了？ exit'Request var not allow!'; 这个地方可以通过提交COOKIE变量绕过cfg等关键字的过滤 接着是注册变量的代码 foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k = $v $$k =...

the iframe of the anti-plug-crack-vulnerability warning-the black bar safety net

Author: emptiness prodigal heart See Monyer of the article: the iframe of the anti-Plug and plug-on http://hi.baidu.com/monyer/blog/item/108c718d9aedcf15b21bba56.html The code is as follows: the window. onload = function iftop!= self var f = document. createElement"form"; f. action=location; f...

Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite

Digital Security Research Group DSecRG Advisory DSECRG-09-006 http://www.dsecrg.com/pages/vul/show.php?id=62 Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL: http://synactis.com Bugs: Null byte File overwriting Exploits: YES Reported: 15.01.2009 Vendor response: NONE...

Easy Grid ActiveX控件任意文件覆盖漏洞

BUGTRAQ ID: 33272 Easy Grid ActiveX控件是用于打印、预览表格、图标、公式、表达式的工具。 EasyGrid.SGCtrl.32 ActiveX控件（EasyGrid.ocx）没有安全地调用DoSaveFile方式，如果用户受骗访问了恶意网页并向该方式传送了特制参数的话，就会导致向用户系统写入任意文件。 Easy Grid Control Team Easy Grid ActiveX 3.51 厂商补丁： Easy Grid Control Team ----------------------...

Discuz! 6.x/7.x $_DCACHE数组变量覆盖漏洞 Check

No description provided by source. !/bin/bash Discuz! 6.x/7.x SODB-2008-13 Check By heihei@安全小站群 文件中googlepagecount参数是 google搜索结果的页数，大于0就可以，太大了，google会认为是自动机而停止处理！ 开启WAP注册的结果URL列表保存在当前目录下urllist 修正 cnb|rd@SEBUG 需要自己修改countPage，因为googlepagecount多了google就以为是病毒呢 countPage=10 flag=0 while "$flag" -lt...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

GLSA-200811-01 : Opera: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200811-01 Opera: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Opera: Opera does not restrict the ability of a framed web page to change the address associated with a different frame CVE-2008-4195. Chri...

phpMyAdmin Import_Blacklist变量覆盖漏洞

BugCVE: CVE-2005-4079 BUGTRAQ: 15761 phpMyAdmin对某些变量的处理上存在漏洞，远程攻击者可能利用此漏洞在主机上执行任意命令。 phpMyAdmin将不应该被registerglobals仿真层覆盖的变量黑名单存储在全局变量中，但却没有包含$importblacklist变量名，因此攻击者可以覆盖该变量。如果覆盖了该变量的话，攻击者就可以用任意内容覆盖$GLOBALS数组，导致执行任意代码。 phpMyAdmin phpMyAdmin 2.7/2.7.0 beta1 phpMyAdmin ----------...

WWWBoard覆盖任意消息漏洞

BugCVE: CVE-1999-0930 BUGTRAQ: 1795 wwwboard.pl是Matt Wright写的一个perl脚本，用来处理web留言板。wwwboard.pl脚本存在一个问题，在用户使用form method=POST提交时没有检查其提交内容。input type=hidden name= followup value=栏的 followup 是相关的前一个消息，如果恶意用户修改了 followup 的值将导致以前存在的留言被覆盖。 2.0 Alpha 2 Matt Wright -----------...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...

CVE-2008-4292

Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory...

CVE-2008-4292

Opera before 9.52 is affected by CVE-2008-4292 due to not checking the CRL override when encountering a certificate that lacks a CRL. The NVD notes the impact is unknown. Gentoo GLSA 200811-01/Security Advisory includes this CVE among multiple Opera vulnerabilities and recommends upgrading to Ope...

Phpcms 2007 common.inc.php远程文件包含漏洞

该cms的核心配置文件/include/common.inc.php有缺陷 -------------------------------------------- //23行开始 @extract$POST, EXTROVERWRITE; @extract$GET, EXTROVERWRITE; unset$POST, $GET; ------------------------------------------------ 这里extract函数会导致变量覆盖，可能引发一系列的问题...

. htaccess Backdoor-vulnerability warning-the black bar safety net

Author: GaRYwofeiwoatgmaildotcom The PHP manual,often see often new: PHP has a characteristic,will be based on apache httpd. conf. htaccess to override their php. ini settings. Just,find two of the evil attributes: ------------------------------ autoprependfile...

DEBIAN-CVE-2008-1149

phpMyAdmin before 2.11.5 accesses $REQUEST to obtain some parameters instead of $GET and $POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery CSRF attacks by using crafted cookies...

CVE-2007-6211

Send ICMP Nasty Garbage sing on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L output log file option. NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to overrid...

Bosdev Multiple vulnerabilities

BosMarket Business Directory System http://www.bosdev.com BosMarket Multiple XSS vulnerabilities BosMarket is a craigslist like application that attempts to let users refer other small businesses. The problem is that when you post listings, its a a no holds barred kind of deal. Firstly, One can...