Cmsez(随易)全站系统 0day

漏洞文件：comments.php viewimg.php ? //comments include "mainfile.php"; $art=new article; //设定 $confirm='yes';//yes:需要管理员认证后才能显示,no:直接显示 $member=new member; $userinfo=$member-memberauth; $ulevel=$userinfouserlevel; 设置 $action = $REQUESTaction; $page="10";// $needuser = "0";// $id = $REQUESTid;//...

DeDeCMS V5 用户验证函数转义符漏洞

在include\incuserlogin.php文件中，checkUser函数对过滤处理不当，导致可以注入转义符，致使系统数据库语句出错。。。 $this-userName = eregreplace"^0-9a-zA-Z@!.-","",$username; ，是不是代码编写人员忘记了，在引号内，转义符只能转义单引号和斜杠 :-P,这样，在变量username中输入一个单引号，变成',然后过滤'留下,导致数据库语句执行出错。 DeDeCMS V5、DeDeCMS 2007 去掉代码中的斜杠，语句改为：$this-userName =...

Jinzora 2.7.5 - index.php Multiple Cross-Site Scripting Vulnerabilities

Jinzora 2.7.5 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27876/info Jinzora is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage...

Sql injection

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the 1 graphlist parameter to graphview.php, 2 leafid and id parameters to tree.php, 3 localgraphid parameter to graphxport.php, and 4...

Buffer overflow

Buffer overflow in Anon Proxy Server 0.102 and earlier, when user authentication is enabled, allows remote attackers to cause a denial of service exception via a user name with a large number of quotes, which triggers the overflow during escaping...

CVE-2008-0633

Buffer overflow in Anon Proxy Server 0.102 and earlier, when user authentication is enabled, allows remote attackers to cause a denial of service exception via a user name with a large number of quotes, which triggers the overflow during escaping...

CVE-2008-0633

Buffer overflow in Anon Proxy Server 0.102 and earlier, when user authentication is enabled, allows remote attackers to cause a denial of service exception via a user name with a large number of quotes, which triggers the overflow during escaping...

CVE-2008-0633

The CVE-2008-0633 entry covers Anon Proxy Server (versions up to 0.102) with a buffer overflow when user authentication is enabled. A username containing a large number of quotes triggers the overflow during escaping, enabling a remote denial of service . Connected documents confirm the affected ...

Anon Proxy Server <= 0.102 remote buffer overflow

====================================================================== Anon Proxy Server = 0.102 remote buffer overflow ====================================================================== Author: L4teral l4teral 4t gmail com Impact: remote buffer overflow Status: patch available...

CVE-2007-6696

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via 1 an event description, 2 the query string to pref.php, and 3 the adv parameter to search.php. NOTE: vector 1 requires user authentication...

CVE-2007-6696

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via 1 an event description, 2 the query string to pref.php, and 3 the adv parameter to search.php. NOTE: vector 1 requires user authentication...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via 1 an event description, 2 the query string to pref.php, and 3 the adv parameter to search.php. NOTE: vector 1 requires user authentication...

CVE-2007-6696

CVE-2007-6696 affects WebCalendar 1.1.6 with multiple cross-site scripting (XSS) vulnerabilities. An attacker can inject arbitrary script/HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php. Vector 1 requires user authentication. The availa...

Microsoft Expression Media Plaintext Password Storage Weakness

CVE-2007-5470 Microsoft Expression Media is prone to a weakness because passwords are stored in plain-text format. This issue stems from a design error in the catalog password-protection feature. Attackers could use this issue in conjunction with other vulnerabilities in a host to gain access to...

Ingres用户认证非授权访问漏洞

BUGTRAQ ID: 26959 CVECAN ID: CVE-2007-6334 Ingres是很多CA产品默认所使用的数据库后端。 Windows平台上的Ingres数据库为之后连接的用户分配了与第一个连接用户相同的权限和身份，这允许远程攻击者获得非授权访问。仅在运行于Microsoft IIS Web服务器上且启用了集成Windows认证（IWA）选项的情况下才会出现这个漏洞。 Ingres Corporation Ingres Database 2.6 Ingres Corporation Ingres Database 2.5 厂商补丁： Ingres Corporation...

Jupiter 1.1.5ex - Privilege Escalation

Jupiter 1.1.5ex - Privilege Escalation Jupiter 1.1.5ex Privileges Escalation body font-size: 10px; font-family: verdana; INPUT BORDER-TOP-WIDTH: 1px; FONT-WEIGHT: bold; BORDER-LEFT-WIDTH: 1px; FONT-SIZE: 10px; BORDER-LEFT-COLOR: D50428; BACKGROUND: 590009; BORDER-BOTTOM-WIDTH: 1px;...

samba security update

CentOS Errata and Security Advisory CESA-2007:1114-01 Updated samba packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba is a suite of programs used b...

DWdirectory 2.1 - SQL Injection

--==+================================================================================+==-- --==+ DWdirectory 2.1 AND PRIOR SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK...

apc-flaw.txt

We have found a security exploit in the latest APC firmware versions for there switched rack PDU products. We have only tested this against the version listed below on a AP7932 0u 30amp PDU. Name: rpdu Version: v3.5.5 Date: 07/18/2007 Time: 11:38:29 Name: aos Version: v3.5.6 Date: 07/18/2007 Time...

That one with Sam the FV key value to the hidden clone account method-vulnerability warning-the black bar safety net

| The principle is very simple Ah sam FV key value. focus on how to avoid detection Generally the detection of clone accounts is the detection of the sam inside there not the same FV. use this feature to bypass the detection. huh --- Step 1.net user allyesno freexploit /add&net localgroup...