FreeBSD telnetd Privilege Escalation

FreeBSD 7.0-RELEASE telnet daemon local privilege escalation - And possible remote root code excution. There is a rather big bug in the current FreeBSD telnetd daemon. The environment is not properly sanitized when execution /bin/login, what leads to a possible remote root hole. The telnet protoc...

Potato News 1.0.0 Local File Inclusion

0x01 Informations: Name : Potato News 1.0.0 Download : http://potato-news.googlecode.com/files/potatonews-1.0.0.zip Vulnerability : LFI Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged file is /path/admin.php Code "; else echo ""; /code 0x03 Exploit: Exploi...

Fedora Core 9 FEDORA-2009-0578 (boinc-client)

The remote host is missing an update to boinc-client announced via advisory FEDORA-2009-0578. OpenVAS Vulnerability Test $Id: fcore20090578.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-0578 boinc-client Authors: Thomas Reinke Copyright: Copyright...

Fedora Core 9 FEDORA-2009-0578 (boinc-client)

The remote host is missing an update to boinc-client announced via advisory FEDORA-2009-0578. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-0587 (boinc-client)

The remote host is missing an update to boinc-client announced via advisory FEDORA-2009-0587. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-0587 (boinc-client)

The remote host is missing an update to boinc-client announced via advisory FEDORA-2009-0587. OpenVAS Vulnerability Test $Id: fcore20090587.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-0587 boinc-client Authors: Thomas Reinke Copyright: Copyright...

CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities

CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities 1. Synopsis All versions of Enomaly ECP/Enomalism prior to 2.1.1 use temporary files in an insecure manner, allowing for symlink and command injection attacks. 2. Impact Information Background Enomaly ECP former...

SuSE Update for kernel SUSE-SA:2007:021

Check for the Version of kernel OpenVAS Vulnerability Test $Id: gbsuse2007021.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for kernel SUSE-SA:2007:021 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...

Max.Blog 1.0.6 - show_post.php SQL Injection

Max.Blog 1.0.6 - showpost.php SQL Injection Salvatore "drosophila" Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:"Powered by Max.Blog" Date: 20 Jan 2009 Discovered by: Salvatore "drosophila" Fresta Author:...

CVE-2009-0248

Cross-site scripting XSS vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter...

[Full-disclosure] Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HTTP Server

Server Version Info: Oracle-Application-Server-10g/10.1.3.1.0 Oracle-HTTP-Server PoC: http://OC4J/web-app/foobar/c0aec0ae/WEB-INF/web.xml Related: https://vulners.com/cve/CVE-2008-2938 Explaination: The "c0aec0ae" is interpreted as: ".." because on Java's side: "c0ae" is interpreted as: "uC0AE"...

Madrese-Portal Sql Injection

Madrese-Portal Sql Injection AUTHOR : Sina Yazdanmehr R3d.W0rm Discovered by : Sina Yazdanmehr R3d.W0rm Our Site : Http://IRCRASH.COM IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm Sina Yazdanmehr - Hadi Kiamarsi Download :...

PhpAddEdit 1.3 - cookie Authentication Bypass

PhpAddEdit 1.3 - cookie Authentication Bypass ------------------------------------- PhpAddEdit 1.3 Login By Pass ------------------------------------- Found By: x0r Evolution Team Email: [email protected] ------------------------------------- Bug In: Addedit-login.php if !$loginerror // --- Se...

php5 -- potential magic_quotes_gpc vulnerability

PHP Developers reports: Due to a security bug found in the PHP 5.2.7 release, it has been removed from distribution. The bug affects configurations where magicquotesgpc is enabled, because it remains off even when set to on...

Gravity GTD 0.4.5 - Local File Inclusion / Remote Code Execution

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl gravity-gtd = 0.4.5 LFI/RCE Vulnerability Script: An open source list manager for tracking action items according to the principles...

Alstrasoft SendIt Pro - Arbitrary File Upload

Alstrasoft SendIt Pro - Arbitrary File Upload AlstraSoft SendIt Pro Remote File Upload ---------------------------------------------------------- Discovered By: ZoRLu Date: 12.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : dork:...

turnkeyforms Software Directory (XSS/SQL) Multiple Vulnerabilities

No description provided by source. ============================================================================== Software Directory v1.0 SQL/XSS Remote SQL Vulnerability ============================================================================== » Script: Software Directory v1.0 » Language: P...

Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= IN THE NAME OF ALLAH -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Pre ADS Portal...

Discuz! admin\runwizard.inc.php get-webshell bug

由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory写文件操作没有限制导致执行代码漏洞. 在文件admin\runwizard.inc.php里代码: $runwizardhistory = array; $runwizardfile = DISCUZROOT.'./forumdata/logs/runwizardlog.php'; if$fp = @fopen$runwizardfile, 'r' $runwizardhistory = @unserializefread$fp, 99999; fclose$fp;...

Microsoft Internet Explorer ' '地址栏URI伪造漏洞

BUGTRAQ ID: 31960 CNCAN ID：CNCAN-2008102905 Microsoft Internet Explorer是一款微软开发的WEB浏览器。 Microsoft Internet Explorer处理非中断空格字符'NBSP;'组合存在问题，远程攻击者可以利用漏洞进行URI伪造攻击。 使用非中断空格字符NBSP, Unicode U+00A0可进行钓鱼攻击，这个字符在地址栏中被渲染为空格NBSP在所有单字节字符集代码页中映射为0xA0，如Windows-1250...Windows-1258...