fenice-overflow.txt

/ Fedora Core 6 exec-shield based Fenice OMS server fenice-1.10.tar.gz remote root exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference: http://www.securityfocus.com/bid/17678 vendor:...

CVE-2007-2139: Undefined Security Weakness

Multiple stack-based buffer overflows in the SUN RPC service in CA formerly Computer Associates BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection Suite 2, allow remot...

CVE-2007-2036

The SNMP implementation in the Cisco Wireless LAN Controller WLC before 20070419 uses the default read-only community public, and the default read-write community private, which allows remote attackers to read and modify SNMP variables, aka Bug ID CSCse02384...

elinks format string vulnerability

Relative path is used to search text strings .po file. It makes it possible to spoof the file and to conduct format string attack...

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)

This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. Module...

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)

This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. This modul...

PHP mail() function invalid characters processing

Unfiltered rn and 0 characters allows strings injection and header truncation...

PHP GD扩展释放资源访问代码执行漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP GD扩展存在设计错误，远程攻击者可能利用此漏洞获得对释放内存的访问并使用恶意数据覆盖而执行任意代码。 问题存在于GD函数中，在通过资源识别器获得资源数据后，可能用usercode来中断PHP函数，usercode就会会破坏资源，并获取与其内存相同位置来分配PHP字符串相同大小的空间作为释放资源。这个字符串可以用于建立特定构建的资源，以允许利用内部PHP函数，当恶意中断终止函数时，会继续使用替代资源数据。导致任意代码执行。 要获得需要的函数中断，通常需要放置对象到函数的某个参数中，这会在转化一个超长值时触发PHP错误。 PHP PHP...

USN-438-1: Inkscape vulnerability

A flaw was discovered in Inkscape's use of format strings. If a user were tricked into opening a specially crafted URI in Inkscape, a remote attacker could execute arbitrary code with user privileges...

Format string

Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeetingloginsert function...

VLC media player: Format string vulnerability

Background VLC media player is a multimedia player for various audio and video formats. Description Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings. Impact An attacker could entice a user to open...

CVE-2007-0404

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a 1 .po or 2 .mo file...

CVE-2005-4817

Format string vulnerability in ui.c in Textbased MSN Client TMSNC before 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code via unknown attack vectors that cause format strings to be injected into the wprintw function...

DEBIAN-CVE-2006-6692

Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using 1 zabbixlog or 2 zabbixsyslog...

CVE-2006-6600

Cross-site scripting XSS vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML via double URL-encoded strings in the dir parameter, a related issue to CVE-2006-5609...

CVE-2006-6600

Cross-site scripting XSS vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML via double URL-encoded strings in the dir parameter, a related issue to CVE-2006-5609...

CVE-2006-6600

CVE-2006-6600 describes a Cross-site Scripting (XSS) vulnerability in TorrentFlux 2.2, specifically in dir.php, where remote attackers can inject arbitrary web script or HTML through double URL-encoded strings in the dir parameter. This is linked to CVE-2006-5609. The provided sources confirm the...

CVE-2006-6252

Microsoft Windows Live Messenger 8.0 and earlier, when gestual emoticons are enabled, allows remote attackers to cause a denial of service CPU consumption via a long string composed of ":D" sequences, which are interpreted as emoticons...

WordPress: Multiple vulnerabilities

Background WordPress is a PHP and MySQL based multiuser blogging system. Description "random" discovered that users can enter serialized objects as strings in their profiles that will be harmful when unserialized. "adapter" found out that user-edit.php fails to effectively deny non-permitted user...

PT-2006-6339 · Ig · Ig Shop

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action...