Microsoft Security Advisory (933052) Vulnerability in Microsoft Word Could Allow Remote Code Executio

Microsoft Security Advisory 933052 Vulnerability in Microsoft Word Could Allow Remote Code Execution Published: February 14, 2007 Microsoft is investigating new public reports of very limited, targeted attacks against Microsoft Word “zero-day” using a vulnerability in Microsoft Office 2000 and...

Aruba Mobility Controller vulnerable to privilege escalation

Overview The Aruba Mobility Controller Management Interface contains a privilege escalation vulnerability. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Aruba Mobility Controllers are used to process and control network traffic in...

Microsoft Security Advisory (932114) Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution

Microsoft Security Advisory 932114 Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution Published: January 26, 2007 Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000. In order for this attack to be carried ou...

Cacti: Command execution and SQL injection

Background Cacti is a web-based network graphing and reporting tool. Description rgod discovered that the Cacti cmd.php and copycactiuser.php scripts do not properly control access to the command shell, and are remotely accessible by unauthenticated users. This allows SQL injection via cmd.php an...

AShop Shopping Cart Multiple XSS Vulnerabilities

Ashop Commerce provides a turn-key ecommerce solution with it's revolutionary online store building software. One of the worlds most easy to use web based administrations with award winning features allows the merchant to set up an online store capable of competing with the webs most powerful...

Cacti cmd.php Multiple Parameter SQL Injection Arbitrary Command Execution

The remote host is running Cacti, a web-based, front end to RRDTool for network graphing. The version of Cacti on the remote host does not properly check to ensure that the 'cmd.php' script is being run from a commandline and fails to sanitize user-supplied input before using it in database...

Cacti copy_cacti_user.php template_user Variable SQL Injection

The remote host is running Cacti, a web-based, front end to RRDTool for network graphing. The version of Cacti on the remote host does not properly check whether the 'copycactiuser.php' script is being run from a commandline and fails to sanitize user-supplied input before using it in database...

Jinzora Multiple Script include_path Parameter Remote File Inclusion

The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The installation of Jinzora on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it in the 'jzBackend.php' script to include PHP code. Provide...

DocuWiki With ImageMagick远程命令执行和拒绝服务漏洞

DocuWiki是一款基于web的WIKI程序。 DocuWiki存在多个安全问题，远程攻击者可以利用漏洞进行拒绝服务和命令执行攻击。 问题一是对图像的调整大小处理没有进行限制，可导致拒绝服务攻击。当libGD使用时（默认需要）必须先计算所需RAM，如果没有足够的RAM（一般8到20MB）给php进程使用，那么函数就会放弃。但是如果使用ImageMagick $conf'imconvert'使用时，没有限制存在，允许攻击者利用此特性消耗大量内存，造成拒绝服务攻击。...

Timesheet Login.PHP SQL注入漏洞

Timesheet是一款基于PHP的网络日记程序。 Timesheet不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Login.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Timesheet PHP Timesheet 1.2.1 http://www.timesheetphp.com/...

Microsoft Security Advisory (929433) Vulnerability in Microsoft Word Could Allow Remote Code Execution

Microsoft Security Advisory 929433 Vulnerability in Microsoft Word Could Allow Remote Code Execution Published: December 5, 2006 Top of sectionTop of section Microsoft is investigating a new report of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000, Microsoft Word 2002,...

MattWrighttextcounter.pl远程执行命令漏洞

textcounter.pl是一个由Matt Wright编写的基于Web的记数器脚本，使用比较广泛。 某些早期版本的textcounter.pl脚本实现上存在输入验证漏洞，远程攻击者可以利用此漏洞以httpd进程的权限在主机上执行任意系统命令。问题在于程序脚本没有过滤用户输入中包含的一些特殊字符，远程攻击者可以向$DOCUMENTURI环境变量注入指定的值，脚本在处理的时候就会以Web守护程序的权限（root或nobody）在主机上执行攻击者指定的任意命令。 Matt Wright TextCounter1.2...

Simple File Manager 0.24a Multiple Remote Vulnerabilities

No description provided by source. /\ | flame vrs Simple File Manager =0.24= | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | | Deletion of...

MailEnable NetWebAdmin Unauthorized Access (ME-10019)

The remote version of MailEnable contains a web-based administration tool that allows a user to login with a blank password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid23755; scriptversion"1.19";...

simple file manager 0.24a - Multiple Vulnerabilities

simple file manager 0.24a - Multiple Vulnerabilities /\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | |...

simple file manager 0.24a - Multiple Vulnerabilities

/\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | | Deletion of Arbitrary files | | Modification of Arbitrary...

Aigaion <= 1.2.1 (DIR) Remote File Include Vulnerabilities

No description provided by source. Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...

aigaion-rfi.txt

Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...

ContentNow Directory Traversal(upload.php)

Software:Web based bibliography management system Download link: http://sourceforge.net/projects/aigaion/ script:basicfunctions.php author: navairum...

Aigaion <= 1.2.1 (DIR) Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== Aigaion = 1.2.1 DIR Remote File Include Vulnerabilities ========================================================== Software:Web based bibliography management system Download link:...