CVE-2007-2306: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the Virtual War VWar 1.5.0 R15 and earlier module for PHP-Nuke, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 memberlist parameter to extra/login.php and the 2 title parameter to...

CVE-2007-2312: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the Virtual War VWar 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however,...

waraxe-2007-SA-048.txt

waraxe-2007-SA048 - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke Author: Janek Vind "waraxe" Date: 13. April 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-48.html Target software description: VWar module for PhpNuke http://www.vwar.de/ VWar is a webbased...

CVE-2007-1567

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or...

Stack overflow

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or...

CVE-2007-1567

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or...

CVE-2007-1567

CVE-2007-1567 is a stack-based buffer overflow in War FTP Daemon (War-FTPD) 1.65 (and possibly earlier) that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, demonstrated with warftp_165.tar by Immunity. Affected product is War-FTPD; the root...

CVE-2007-1567: Undefined Security Weakness

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or...

Unfixed XSS vulnerability at www.lifeinkorea.com

Security researcher MaXWeL, has submitted on 17/03/2007 a cross-site-scripting XSS vulnerability affecting www.lifeinkorea.com, which at the time of submission ranked 78092 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/03/2007. It is...

JBoss JMX Console Deployer Upload and Execute

This module can be used to execute a payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:MainDeployer functionality. To accomplish this, a temporary HTTP server is created to serve a WAR archive containing our payload...

VWar <= 1.50 R14 (online.php) Remote SQL Injection Vulnerability

No description provided by source. .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: 1o.o8.2oo6 .. Affected Application: VWar = v1.50 R14 . . : contact :...

WarFTPd多个命令处理远程拒绝服务漏洞

War FTP Daemon是32位Windows平台上的FTP服务器。 WarFTPd在处理多个命令的畸形参数时存在漏洞，远程攻击者可能利用此漏洞对服务器造成拒绝服务。 如果向各种命令发送了包含有两次“%s”字符的超长字符串的话，就会导致WarFTPd拒绝服务。例如，发送以下命令： $ ftp target Banner ftp quote user anonymous ftp quote pass bla ftp cwd %s256 或者： ftp cdup %s256 就会导致服务器崩溃： EAX 00000001 ECX 00000073 EDX 00000002 EBX...

CVE-2006-5789

War FTP Daemon WarFTPd 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of "%s" format strings in 1 CWD, 2 CDUP, 3 DELE, 4 NLST, 5 LIST, 6 SIZE, and possibly other commands. NOTE: it is possible that vector 1 is an off-by-one variant or incomplete fix...

CVE-2006-5789

War FTP Daemon WarFTPd 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of "%s" format strings in 1 CWD, 2 CDUP, 3 DELE, 4 NLST, 5 LIST, 6 SIZE, and possibly other commands. NOTE: it is possible that vector 1 is an off-by-one variant or incomplete fix...

CVE-2006-5789

WarFTPd 1.82.00-RC11 is affected by multiple remote format-string vulnerabilities. The OpenVAS notes indicate the server is prone to format-string issues caused by unsanitized input being passed to formatted-output functions, enabling a denial of service (and potentially arbitrary code execution)...

CVE-2006-5789: Undefined Security Weakness

War FTP Daemon WarFTPd 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of "%s" format strings in 1 CWD, 2 CDUP, 3 DELE, 4 NLST, 5 LIST, 6 SIZE, and possibly other commands. NOTE: it is possible that vector 1 is an off-by-one variant or incomplete fix...

vwarSQL.txt

Vendor : www.vwar.de Vuln. Ver. : 1.5.0 and lower Dork : "Powered by : Virtual War v1.5.0" intext:"www.vwar.de" ------------------------------------------- Author : MFox Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team ------------------------------------------- PoC :...

vwar150multi.txt

Virtual War v1.5.0 SQL injection and XSS http://host/vwar/war.php?s=SQL http://host/vwar/war.php?page=SQLorxss http://host/vwar/war.php?showgame=SQL http://host/vwar/war.php?sortby=sql http://host/vwar/war.php?sortorder=sql http://host/vwar/calendar.php?year=xss vendor: www.vwar.de google:"Powere...

CVE-2006-4224

Cross-site scripting XSS vulnerability in calendar.php in Virtual War VWar 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. NOTE: The page parameter vector is covered by CVE-2006-4009...

CVE-2006-4224

CVE-2006-4224 is an XSS vulnerability in Virtual War (VWar) calendar.php affecting VWar 1.5.0 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the year parameter. The CVE also notes that the page parameter vector is covered by CVE-2006-4009. No fur...