Remote code execution

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...

HTTP Payload CRLF Injection

A CRLF Injection over HTTP payload vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to change the server's behavior...

CVE-2016-0923

The client in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server...

Mail.ru: e.mail.ru: File upload "Chapito" circus

Начинаем пихать зиробайты в имя файла на загрузке и поведение сервера неадекватно. Пока ничего страшнее чем local path disclosure, но боюсь импакт больше чем кажется. В имени файла в примере "������t123123", в хексе "220000000000007431323331323322" POST...

Adobe RoboHelp Server SQL Injection (CVE-2008-2991)

Adobe RoboHelp Server is a server-based Help solution that provides real-time end-user feedback on Help and knowledge bases. It gathers and logs data about what questions users ask, while searching content and how users navigate through topics. There exists an SQL injection vulnerability in Adobe...

Command injection

X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which allows remote FTP servers to cause a denial of service infinite loop by 1 repeatedly sending a 550 error response, or 2 sending a 550 error response and then...