WordPress Charset解抹SQL注入漏洞

WordPress是一款流行的网络日记程序。 WordPress处理字符集解码存在问题，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 在当PHP的mbstring扩展激活时，WordPress支持使用不同字符集解码Trackback，因为解码发送在数据库为输入数据执行选择正确的字符集之前，因此允许绕过针对SQL注入的保护。 为了演示需要，Stefan Esser建议使用UTF-7字符集来利用，因为其他的多字节字符集允许多字节序列以''结尾。...

CVE-2006-7232

sqlselect.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service crash via an EXPLAIN SELECT FROM on the INFORMATIONSCHEMA table, as originally demonstrated using ORDER BY...

Acronym Mod v0.9.5 Remote SQL Injection Vulnerability

Acronym Mod v0.9.5 Remote SQL Injection Vulnerability Download: http://www.codemonkeyx.net Found By: the master exploit: http://Target/Path/admin/adminacronyms.php?mode=edit&id=-120UNION20SELECT20null,userpassword,null20FROM20phpbbusers20where20userid=2&sid=AdminHash Greetz: str0ke , Dr Max Virus...

MailEnable IMAP Server multiple security vulnerabilities

Buffer overflow in EXAMINE, SELECT, DELETE commands...

CVE-2006-6290

Multiple stack-based buffer overflows in the IMAP module MEIMAPS.EXE in MailEnable Professional 1.6 through 1.82 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.30 and 2.0 through 2.33 allow remote authenticated users to cause a denial of service crash or possibly execute arbitrary...

Q-Shop v3.5(browse.asp) Remote SQL Injection Vulnerability

Vulnerability Report Title : Q-Shop v3.5browse.asp Remote SQL Injection Vulnerability Author : ajann Script Page : http://quadcomm.com Exploit; http://target/path/browse.asp?cat=42&ManuID=&OrderBy=SQL HERE Example:...

CVE-2006-4544

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...

ATutor <= 1.5.3.1 (links) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================ ATutor = 4.1 allowing SELECT subqueries for ORDER BY statements see http://dev.mysql.com/doc/refman/5.0/en/subqueries.html - with at least 2 links in atlinks table / if $argc5 ec...

WinGate IMAP Server Directory Traversal Vulnerabilities

The remote host appears to be running WinGate, a Windows application for managing and securing Internet access. The version of WinGate installed on the remote host fails to remove directory traversal sequences from the 'CREATE', 'SELECT', 'DELETE', 'RENAME', 'COPY', 'APPEND', and 'LIST' commands...

CVE-2006-3052

Cross-site scripting XSS vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the 1 eventid parameter to view-event-details.php or 2 selectevents parameter to event-registration.php. NOTE: the provenance of this information is unknown; the details...

Directory traversal

Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the 1 CREATE, 2 SELECT, 3 DELETE, 4...

CVE-2006-2308: Undefined Security Weakness

Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the 1 CREATE, 2 SELECT, 3 DELETE, 4...

Privilege escalation using addSelectionListener — Mozilla

Web content could access the nsISelectionPrivate interface of the Selection object and use it to add a SelectionListener. The listener would be called when the user did a "Find" on the page or a "select all", and as intended this shouldn't cause any problems. But as with escaping the PAC sandbox ...

CVE-2006-1705

Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view...

CVE-2006-1705

Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view...

CVE-2006-1705: Undefined Security Weakness

Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view...

Mercur MailServer 5.0 SP3 - 'IMAP' Denial of Service

/ Exploit for : IMAP 5.0 SP3 DoS Exploit Advisory : http://secunia.com/advisories/19267/ Coder : Omnipresent Email : [email protected] Description : Tim Taylor has discovered a vulnerability in Mercur Messaging 2005, which can be exploited by malicious people and by malicious users to cause a...

CVE-2006-0798: Undefined Security Weakness

Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create, modify, or delete directories via a .. dot dot in the argument to the 1 CREATE, 2 SELECT, 3 DELETE, or 4 RENAME...

CVE-2006-0369: Exposure of Sensitive Information to an Unauthorized Actor

MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT FROM informationschema.views;" query, which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability of the schema is a normal an...

PHPNukeEV77.txt

PHPNuke EV 7.7 'search' module 'query' variable SQL injection Vendor url: http://nukevolution.com/ exploit available:yes vendor notify:yes advisore:http://lostmon.blogspot.com/2006/01/ phpnuke-ev-77-search-module-query.html PHPNuke EV 7.7 have a flaw which can be exploited by malicious people to...