phpBB Advanced Quick Reply Hack 1.01.1 - Remote File Inclusion

phpBB Advanced Quick Reply Hack 1.01.1 - Remote File Inclusion source: https://www.securityfocus.com/bid/6173/info The phpBB Advanced Quick Reply Hack is prone to an issue which may allow attackers to include arbitrary files from a remote server. It is possible for remote attackers to influence t...

Code Injection in phpBB Advanced Quick Reply Mod

Software: phpBB Advanced Quick Reply Mod I've found a security hole in this sofware Code Injection. You can download this software at http://phpbbhacks.com/viewhack.php?id=586 Hackers can exploit this Mod to inject some shell code to hack your forum, your website or your server local exploit...

Slash-based bulletin boards contain a "quick login" feature that may disclose username and password

Overview Slash-based bulletin boards contain a vulnerability that may cause users to disclose their username and password to third-party sites. Description As described in the Slashcode FAQ, "Slash is a database-driven news and message board, using Perl, Apache and MySQL." Slash allows web site...

mantisbt security flaw

Hi, Mantis is php/MySQL/web based bug tracking system, available at http://mantisbt.sourceforge.net/. It currently suffers from a classical PHP bad coding practice altough i would bet on distraction for this particular situation , that may result on remote command execution via a include file...

postnuke v 0.7.0.3 remote command execution

post nuke is one of popular content management system written in php . there are bug in file user.php line 107 which user can append $caselist array with their own value. foreach $caselist as $k=$v $ModName = $v'module'; include "$vpath/$k"; $caselist = array;...

Pi3Web/2.0.0 File-Disclosure/Path Disclosure vuln

Pi3Web/2.0.0 File-Disclosure/Path Disclosure Vulnerability Discovered by: Teknophreak of Malloc Date: March 9 2002 Contact: [email protected] Pi3Web is a Webserver available for multiple Microsoft Windows platforms. There are multiple disclosure flaws within the webserver that may assist an...

Переполнение буфера в Apple Quick Time (buffer overflow)

Переполнение буфера при обработке Content-Type:...

basilix bug

+--------------------------------------+ | Basilix Webmail System Vulnerability | +--------------------------------------+ Release Date : 13:49, 6 July 2001 Version Affected : Basilix Webmail System 1.0.2beta Basilix Webmail System 1.0.3beta Description : basilix lunches a file which name is read...

Solaris whodo Vulnerability

Vulnerability in Solaris whodo Date Published: July 5, 2001 Advisory ID: N/A Bugtraq ID: 2935 CVE CAN: Non currently assigned. Title: Solaris whodo Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The whodo...

[synnergy] - Solaris mailtool(1) buffer overflow vulnerability

Vulnerability in Solaris mailtool1 Date Published: May 29, 2001 Advisory ID: N/A Bugtraq ID: N/A Sun Bug ID: 4458476 CVE CAN: Non currently assigned. Title: Solaris mailtool1 Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerable...

Solaris mailx Vulnerability

Vulnerability in Solaris mailx1 Date Published: April 11, 2001 Advisory ID: N/A Bugtraq ID: N/A CVE CAN: Non currently assigned. Title: Solaris mailx1 Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The mai...

Vulnerabilities in Alex's FTP Server

----- Begin Hush Signed Message from [email protected] ----- Vulnerabilities in Alex's FTP Server Overview Alex's Ftp Server v0.7 is an ftp server available from http://www.alex.feedback.net. Vulnerabilities exist which allow a user to break out of the ftp root. Details The following is an...

Format string bug in startinnfeed

Description -------------- The 'startinnfeed' binary contains various format string bugs. Most of the command line options passes user given arguments to 'syslog' as format string. For example: paul@ps:/usr/home/paul /usr/lib/news/bin/startinnfeed -a "xxnnnnnnn" segmentation fault...

Vulnerability in Free Java Web Server

Vulnerability in Free Java Web Server Overview Free Java Web Server v1.0 is a Java web server available from http://www.download.com. A vulnerability exists which allows a remote user to break out of the web root using relative paths ie: '..', '...'. Details http://localhost/../file outside web...

[SPSadvisory#41]Apple Quick Time Plug-in Buffer Overflow

SPS Advisory 41 Apple Quick Time Plug-in Buffer Overflow UNYUN [email protected] Shadow Penguin Security http://shadowpenguin.backsection.net -------------------------------------------------------------- Date July 31, 2001 Vulnerable QuickTime Player 4.1.2 for Windows Japanese Not...

PHP Phorum quick fix

The major problem in Phorum, if all else is secured with the admin area off limits to anyone, seems to be the reading of local server files. In that last email on this in the correspondance part you can see the following... snip Hi jason, The fix that is provided in Phorum's site doesn't...

irix.telnetd.txt

We've found a very severe vulnerability in the IRIX telnetd service that upon successful exploitation can give remote root access to any IRIX 6.2-6.5.8m,f system. The bug discussed here appeared in IRIX 5.2-6.1 systems and was the result of SGI efforts to patch a security vulnerability reported b...

glftpd.privpath.txt

Glftpd 1.18 till 1.21b8 current beta have a serious problem with the privpath directives.... It will probably be fixed in the comming 1.21b9 but i have included a quick fix in this one to prevent exploits of this bug. Thanx for Hoopy for the quick fix glftpd dev team. Problem: When you know the...

snplog.bof.txt

Date: Tue, 16 Feb 1999 00:42:49 +0000 From: Rupert Weber-Henschel To: [email protected] Subject: snplog-1.0 buffer overflow There is a possible buffer overflow in snplog-1.0. Or is it 0.1? The tar file is 0.1, the docs say 1.0. % snplog contains tcplogd, icmplogd, udplogd The offending code is...

ssh-2.0.12.brute.force.txt

Date: Wed, 9 Jun 1999 15:51:54 +0200 From: [email protected] To: [email protected] Subject: ssh advirsory Aleph ... Sorry if it is an old bug ... i have tested a bug in ssh-2.0.12. any remote attacker can guess real account in the machine Details when a ssh client connects to the daemo...