2196 matches found
Joomla Component JVideo 0.3.x SQL Injection Vulnerability
Exploit for unknown platform in category web applications ========================================================= Joomla Component JVideo 0.3.x SQL Injection Vulnerability =========================================================...
Design/Logic Flaw
The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted...
Important: Red Hat Security Advisory: kernel security and bug fix update
Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...
FreeBSD : bmon -- unsafe set-user-ID application (938f357c-16dd-11d9-bc4a-000c41e2cdad)
Jon Nistor reported that the FreeBSD port of bmon was installed set-user-ID root, and executes commands using relative paths. This could allow local user to easily obtain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
FreeBSD : ifmail -- unsafe set-user-ID application (746ca1ac-21ec-11d9-9289-000c41e2cdad)
Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...
Ubuntu 6.06 LTS / 7.04 / 7.10 : openssh vulnerabilities (USN-649-1)
It was discovered that the ForceCommand directive could be bypassed. If a local user created a malicious /.ssh/rc file, they could execute arbitrary commands as their user id. This only affected Ubuntu 7.10. CVE-2008-1657 USN-355-1 fixed vulnerabilities in OpenSSH. It was discovered that the fixe...
FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (92268205-1947-11d9-bc4a-000c41e2cdad)
The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...
Jinzora name Parameter Local File Inclusion
The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The version of Jinzora installed on the remote host fails to filter user-supplied input to the 'name' variable in the 'index.php' script when 'op' is set before using it to include PHP code...
ZABBIX < 1.6.3 Web Interface locales.php extlang[] Remote Code Execution
Binary data 4951.prm...
Coppermine Photo Gallery keysToSkip Parameter Overwrite
The version of Coppermine Photo Gallery installed on the remote host contains a flaw in the anti-registerglobals protective code in 'include/init.inc.php'. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated, remote attacker can leverage this issue using a specially crafted...
Coppermine Photo Gallery <= 1.4.20 (BBCode IMG) Privilege Escalation
No description provided by source. +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | by Juri Gianni aka yeat -...
Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation
Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | b...
Jaws language Parameter Multiple Local File Includes
Jaws, a Framework and Content Management System for building dynamic websites, is installed on the remote system. The installed version fails to filter input to the 'language' parameter before using it to include PHP code in '/upgrade/index.php' and '/install/index.php'. Regardless of PHP's...
PLE CMS 1.0 Beta 4.2 SQL Injection
--+++==============================================================+++-- --+++====== PLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit ======+++-- --+++==============================================================+++-- ". "\n+ Ex. : php xpl.php localhost /PLECMS root...
OpenX fc.php MAX_type Parameter Traversal Local File Inclusion
The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'MAXtype' parameter of the 'www/delivery/fc.php' script before using it in a PHP 'include' function. Regardless of...
HTTP NULL User ID and Password (deprecated)
Binary data 4842.prm...
Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH Command Buffer Overflow Vulnerability
Oracle Secure Backup NDMPCONECTCLIENTAUTH Command Buffer Overflow Vulnerability 2009.January.13 Fortinet's FortiGuard Global Security Research Team Discovers Vulnerability in Oracle Secure Backup Summary: ======== A Buffer Overflow vulnerability exists Oracle Secure Backup 10.2.0.2 through a...
serv-u7 local exploit (php)-bug warning-the black bar safety net
Note: since the author is lazy, does not provide the log cleaning function that will leave the log: One, the su7 is the right there are several? There are two forms to get rid of su7 in. 1, login to the Administrator Console page ==get the OrganizationId for Add User ==get the global user of...
XOOPS Multiple Scripts mydirname Parameter Arbitrary Command Injection
The version of XOOPS installed on the remote host fails to filter user-supplied input to the 'mydirname' parameter of the 'onupdate.php', 'notification.php', and 'oninstall.php' scripts under the application's 'xoopslib/modules/protector' directory before passing it to PHP 'eval' functions...
XStandard Lite Plugin for Joomla! X_CMS_LIBRARY_PATH Header Directory Traversal
The version of Joomla! running on the remote host is distributed with a WYSIWYG editor plugin known as XStandard Lite. This plugin is affected by an information disclosure vulnerability in the attachmentlibrary.php script due to improper sanitization of user-supplied input to the XCMSLIBRARYPATH...