20146 matches found
CVE-2017-12814
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable...
CVE-2017-12814
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable...
Perl Stack Buffer Overflow Vulnerability
Perl is a free and powerful cross-platform programming language developed by American programmer Larry Wall. A stack buffer overflow vulnerability exists in the CPerlHost::Add method of the win32/perlhost.h file in versions of Perl prior to 5.24.3-RC1 and 5.26.x prior to 5.26.1-RC1. An attacker...
CVE-2017-14867
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...
UBUNTU-CVE-2017-14867
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...
Git cvsserver Remote Command Execution Vulnerability
The git subcommand cvsserver is a Perl script which makes excessive use of the backtick operator to invoke git. Unfortunately user input is used within some of those invocations and it allows for OS command injection. Versions before before 2.14.2, 2.13.6, 2.12.5, 2.11.4 and 2.10.5 are affected...
Git cvsserver Remote Command Execution
Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products Git before 2.14.2, 2.13.6, 2.12.5, 2.11.4 and 2.10.5 git-cvsserver https://git-scm.com Vendor communication 2017-09-08 Sent vulnerability details to the git-security list 2017-09-09 Acknowledgement of t...
Internet Bug Bounty: Perl $ENV Key Stack Buffer Overflow
The CPerlHost::Add method in win32\perlhost.h is vulnerable to a stack buffer overflow. void CPerlHost::AddLPCSTR lpStr char szBuffer1024; LPSTR lpPtr; int index, length = strlenlpStr+1; forindex = 0; lpStrindex != '\0' && lpStrindex != '='; ++index szBufferindex = lpStrindex; szBufferindex = '\0...
CVE-2017-12814
CVE-2017-12814 affects Windows builds of Perl prior to 5.24.3-RC1 and 5.26.x prior to 5.26.1-RC1, due to a stack-based overflow in CPerlHost::Add (win32/perlhost.h). An overly large ENV key can overflow a fixed stack buffer, enabling arbitrary code execution. Public details confirm affected versi...
CVE-2017-12814
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable...
Internet Bug Bounty: Interger overflow in eval trigger write out of bound
Hi security team, i reported some samples triggered crash in eval funtion in perl. The bug come because variable start and items used type I32 which takes half the range of linet and folds it into negative numbers, leading to trying to store the lines at negative indexes...
FreeBSD : perl -- multiple vulnerabilities (d9e82328-a129-11e7-987e-4f174049b30a)
SO-AND-SO reports : CVE-2017-12814: $ENV$key stack-based buffer overflow on Windows A possible stack-based buffer overflow in the %ENV code on Windows has been fixed by removing the buffer completely since it was superfluous anyway. CVE-2017-12837: Heap buffer overflow in regular expression...
Debian: Security Advisory (DSA-3984-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Internet Bug Bounty: Format string implementation vulnerability, resulting in code execution
In a security audit to the sprintf implementation in perl version 5.24.1 I found a major security vulnerability, here are the full details. Timeline: ====== 6th of May, 2017 - disclosure to the PERL security mailing list 8th of May, 2017 - vulnerability confirmed by PERL's security group, found...
Cash Back Comparison Script 1.0 - SQL Injection Exploit
Exploit for php platform in category web applications !/usr/bin/perl -w Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection Dork: N/A Date: 22.09.2017 Vendor Homepage: http://cashbackcomparisonscript.com/ Software Link: http://cashbackcomparisonscript.com/demo/features/ Demo:...
Stock Photo Selling 1.0 - SQL Injection Exploit
Exploit for php platform in category web applications !/usr/bin/perl -w Exploit Title: Stock Photo Selling Script 1.0 - SQL Injection Dork: N/A Date: 21.09.2017 Vendor Homepage: http://sixthlife.net/ Software Link: http://sixthlife.net/product/stock-photo-selling-website/ Demo:...
Debian DSA-3982-1 : perl - security update
Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2017-12837 Jakub Wilk reported a heap buffer overflow flaw in the regular expression compiler, allowing a...
Cash Back Comparison Script 1.0 - SQL Injection
Cash Back Comparison Script 1.0 - SQL Injection !/usr/bin/perl -w Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection Dork: N/A Date: 22.09.2017 Vendor Homepage: http://cashbackcomparisonscript.com/ Software Link: http://cashbackcomparisonscript.com/demo/features/ Demo:...
Cash Back Comparison Script 1.0 SQL Injection
!/usr/bin/perl -w Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection Dork: N/A Date: 22.09.2017 Vendor Homepage: http://cashbackcomparisonscript.com/ Software Link: http://cashbackcomparisonscript.com/demo/features/ Demo: http://www.cashbackcomparison.info/ Version: 1.0 Category:...
Cash Back Comparison Script 1.0 - SQL Injection
!/usr/bin/perl -w Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection Dork: N/A Date: 22.09.2017 Vendor Homepage: http://cashbackcomparisonscript.com/ Software Link: http://cashbackcomparisonscript.com/demo/features/ Demo: http://www.cashbackcomparison.info/ Version: 1.0 Category:...