PHP move_uploaded_file security restrictions bypass Vulnerability(CVE-2 0 1 5-2 3 4 8)-vulnerability warning-the black bar safety net

Affected system: PHP PHP 5.6. x PHP PHP 5.5. x PHP PHP 5.4.39 Description: CVECAN ID: CVE-2 0 1 5-2 3 4 8 PHP is a General-purpose open source scripting language. PHP 5.4.39, and 5.5. x, 5.6. x version of ext/standard/basicfunctions. c, moveuploadedfile encountered\x00 characters will truncate th...

PHP arbitrary file upload Vulnerability, CVE-2 0 1 5-2 3 4 8 analysis-vulnerability warning-the black bar safety net

Last night security news broke of a“PHP arbitrary file upload Vulnerability”, CVE number: CVE-2 0 1 5-2 3 4 8 in. At the time landlord is ready to pack up and go home, see this news my heart a surprised: the lost rivers and lakes for many years the 0 character truncation upload vulnerability and...

CVE-2015-2348

The moveuploadedfile implementation in ext/standard/basicfunctions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected...

CVE-2015-2348: Undefined Security Weakness

The moveuploadedfile implementation in ext/standard/basicfunctions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected...

PT-2015-1036

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.39 PHP versions 5.5.x prior to 5.5.23 PHP versions 5.6.x prior to 5.6.7 Description The issue is related to the move uploaded file implementation in PHP, which truncates a pathname when encountering a x00 character...

Updated vlc packages fix security vulnerabilities

Updated vlc packages fix security vulnerabilities: On 32 bit builds, parsing of update status files with a size of 4294967295 or more lead to an integer truncation caused by a cast to sizet in a call to malloc and a subsequent buffer overflow. This happened prior to checking the files' signature...

itBit Exchange: Email Length Verification

Hello ItBit Security Team! I am Simone, a sixteen years old Italian Security research, and I just want to share with you one of my finding on your website. NOTE:I reccomend you to read all this report with attwntion because it's a really particular vulnerability.. at first impact, this issue will...

PT-2015-4313

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions prior to 2.1.6 Description The issue is related to an integer truncation in the automated updater, specifically in the GetUpdateFile function, which allows remote attackers to conduct buffer overflow attacks...

PT-2015-3378

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions prior to 2.1.6 Description The issue is related to an integer truncation in the MP4 Demuxer of the VideoLAN VLC media player. This can be exploited by remote attackers to cause a denial of service or possibly...

齐博地方门户系统sql注入

简要描述： 变量未初始化导致注入 详细说明： 齐博地方门户系统 齐博的全局过滤系统中由于存在如下代码，导致传入的参数可以成为全局变量 foreach$COOKIE AS $key=$value unset$$key; foreach$POST AS $key=$value !ereg"^\A-Z+",$key && $$key=$POST$key; foreach$GET AS $key=$value !ereg"^\A-Z+",$key && $$key=$GET$key; 所以系统中如果存在未初始化的变量，容易导致注入 2shou/post.php中 180行...

SAP SQL Anywhere .NET Data Provider REPLICATE Function Heap Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of the REPLICATE function. If an application allows untrusted input to be used as the length of a REPLICATE functio...

Mavenlink: Email field filtering problem.

From the page: https://app.mavenlink.com/settings/email When I tried to update the email address, I noticed that the database field was allocating 255 characters there.And if the input was more than 255 character that field was truncating. For example: text...

Laravel 2.1 Hash::make() bcrypt Truncation

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Laravel 2.1 Hash::make bcrypt truncation Website : http://laravel.com/ Author : @u0x Pichaya Morimoto Release dates : September 16, 2014 Special Thanks to 2600 Thailand group...

Laravel - 'Hash::make()' Password Truncation Security

source: https://www.securityfocus.com/bid/69849/info Laravel is prone to a security weakness due to pseudo password hash collision. Attackers can exploit this issue to bypass intended security restrictions. This may aid in further attacks. // user input password $input = strrepeat'A',72; //...

CVE-2014-3170

Removed by vendor...

CVE-2014-3170

extensions/common/urlpattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '\0' character in a host name, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character...

CVE-2014-3170: Undefined Security Weakness

extensions/common/urlpattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '\0' character in a host name, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character...

Wordpress 2.6.1 - SQL Column Truncation Admin Takeover

...

CVE-2014-5015

bozotic HTTP server aka bozohttpd before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path...

UBUNTU-CVE-2014-5015

bozotic HTTP server aka bozohttpd before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path...