CVE-2009-0037: Cross-Site Request Forgery (CSRF)

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

FreeBSD : curl -- cURL/libcURL Location: Redirect URLs Security Bypass (5d433534-f41c-402e-ade5-e0a2259a7cb6)

Secunia reports : The security issue is caused due to cURL following HTTP Location : redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially...

CURL-CVE-2009-0037 Arbitrary File Access

When told to follow a "redirect" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus "trick" a libcurl-using application to read a local file instead of the remote one. This is a...

Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities

No description provided by source. Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP Top Ten vulnerabilities" Too bad it doesn't defend its...

Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery Cross-Site Scripting

Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery Cross-Site Scripting Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP...

Cisco IOS, Cisco 10000, uBR10012, uBR7200 and Cisco UCM multiple security vulnerabilities

DoS with L2TP, MPLS, IPS, SIP, SSL vulnerabilities, information leaks, multiple multicast security vulnerabilities, NAT SCP, IOS Software firewall application inspection security vulnerabilities...

Gentoo Security Advisory GLSA 200602-11 (OpenSSH)

The remote host is missing updates announced in advisory GLSA 200602-11. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-200802-06 : scponly: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200802-06 scponly: Multiple vulnerabilities Joachim Breitner reported that Subversion and rsync support invokes subcommands in an insecure manner CVE-2007-6350. It has also been discovered that scponly does not filter the -o and -...

scponly: Multiple vulnerabilities

Background scponly is a shell for restricting user access to file transfer only using sftp and scp. Description Joachim Breitner reported that Subversion and rsync support invokes subcommands in an insecure manner CVE-2007-6350. It has also been discovered that scponly does not filter the -o and ...

CVE-2007-6415: Improper Control of Generation of Code

scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options...

Debian Security Advisory DSA 540-1 (mysql)

The remote host is missing an update to mysql announced via advisory DSA 540-1. OpenVAS Vulnerability Test $Id: deb5401.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 540-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

scponly本地任意命令执行漏洞

scponly是一款可替代shell系统，可提供帐户在不需要shell访问的情况下进行scp和sftp操作。 scponly存在设计错误，本地攻击者可以利用漏洞绕过安全限制，执行任意命令。 通过本地建立一个使用包含 nc -l -p 1042 -e /bin/bash &命令的/tmp/blubb/hooks/post-commit的/tmp/blubb subversion库，使用scp -r /tmp/blubb/ user@host:拷贝这个库。然后远程检查库：ssh user@host /usr/bin/svn co file:///home/user/blubb...

Heap overflow

Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine, and thereby cause...

CVE-2007-6181

Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine, and thereby cause...

CVE-2007-6181: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine, and thereby cause...

CVE-2007-6181

CVE-2007-6181: A heap-based buffer overflow in cygwin1.dll affects Cygwin 1.5.7 and earlier. An authenticated remote attacker can exploit a long filename via SCP to trigger overwrite of heap memory in scp.exe, enabling arbitrary code execution on the Cygwin host. Related reports extend exposure t...

CVE-2007-6181

Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine, and thereby cause...

Design/Logic Flaw

Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a 1 UNC share pathname, or a 2 ftps, 3 ssh2.sftp, or 4 ssh2.scp URL, in the page parameter, for which PHP remote file inclusion is blocked only for http, https...

CVE-2007-4909

WinSCP (before 4.0.4) is affected by an interpretation conflict in its URL handler that lets remote attackers perform arbitrary file transfers via certain scp/sftp/ftp URLs, by abusing a login-as-username on the URL which is parsed differently by the protocol handler. The issue is described as a ...

CVE-2007-4909: Undefined Security Weakness

Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a 1 scp, and possibly a 2 sftp or 3 ftp, URL, as demonstrated by a URL specifying login to the remote server with a...