2241 matches found
JVN#84565055 Lotus Domino cross-site scripting vulnerability
IBM Lotus Domino is server software for Lotus Notes, groupware from IBM. Lotus Domino contains a cross-site scripting vulnerability. Impact An attacker could execute an arbitrary script on the web browser of a user who accesses a Lotus Domino server. Solution Update the Software For Lotus Domino...
Seditio CMS 121 - pfs.php Arbitrary File Upload
Seditio CMS 121 - pfs.php Arbitrary File Upload Seditio CMS Remote File Upload Vulnerability ReSearcher : A.D.T Script : Seditio and Ldu Cms Version : All Versions Script HomePage : http://neocrome.net/ Dork : "powered by seditio" or "powered by ldu" Risk : Very High! Usage : Firstly, you registe...
CVE-2007-3083
Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...
Improper access control
Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...
CVE-2007-3083
CVE-2007-3083 affects Z-Blog 1.7, where sensitive data is stored under the web root with insufficient access control. An attacker can directly access zblog.mdb to download the database, per NVD entry. The CVSS v2 vector (AV:N/AC:L/Au:N/C:C/I:N/A:N) yields a base score of 7.8 (High). No remediatio...
CVE-2007-3083
Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...
Z-Blog 1.7 Authentication Bypass Database Download Vulnerability
Author : Hasadya Raed Contact : [email protected] Israel Hacker Greetz : Fairoz : Advisory : Z-Blog 1.7 Authentication Bypass/Database Download Vulnerability Script : Z-Blog 1.7 Impact : Remote Googledork : "Powered by Z-Blog 1.7" , "Powered By Z-Blog 1.7 Laputa Build 70216" Download :...
Design/Logic Flaw
SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for 1 the server pid file, which allows local users to cause arbitrary processes to be stopped, or 2 when BPXBATCHUMASK is missing from the environment, creates HFS files with insecure permissions, which allows...
CVE-2007-2063
SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for 1 the server pid file, which allows local users to cause arbitrary processes to be stopped, or 2 when BPXBATCHUMASK is missing from the environment, creates HFS files with insecure permissions, which allows...
CVE-2007-2063
SSH Tectia Server for IBM z/OS is affected up to version 5.3.x; prior releases, before 5.4.0, use insecure world-writable permissions for (1) the server pid file, enabling local users to stop arbitrary processes, and (2) when _BPX_BATCH_UMASK is missing, HFS files with insecure permissions, allow...
CVE-2007-2063
SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for 1 the server pid file, which allows local users to cause arbitrary processes to be stopped, or 2 when BPXBATCHUMASK is missing from the environment, creates HFS files with insecure permissions, which allows...
SSH Tectia Server for IBM z/OS本地权限提升漏洞
SSH Tectia客户端/服务器解决方案是基于Secure Shell技术的多平台点到点通讯安全解决方案，SSH Tectia Server for IBM z/OS是其中的一个产品模块。 SSH Tectia Server安装文件时设置了不安全的访问权限，本地攻击者可能利用此漏洞提升自己的权限。 SSH Tectia Server for IBM z/OS以完全可写的权限创建文件和目录，因此本地用户可以删除、控制或替换某些文件，获得权限提升。 SSH Communications Security SSH Tectia Server for IBM z/OS 5.4.0...
CYBSEC Security Pre-Advisory: SAP RFC_SET_REG_SERVER_PROPERTY RFC Function Denial Of Service
The following pre-advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-SecurityAdvisorySAPRFCSETREGSERVERPROPERTYRFCFunctionDenialofService.pdf CYBSEC S.A. www.cybsec.com Pre-Advisory Name: SAP RFCSETREGSERVERPROPERTY RFC Function Denial Of Service...
Code injection
inc/filebrowser/browser.php in deV!Lz Clanportal DZCP 1.4.5 and earlier allows remote attackers to obtain MySQL data via the inc/mysql.php value of the file parameter...
Trojan“add/shelling”implementation-vulnerability warning-the black bar safety net
Why the“plus/shelling”for? For hackers, this technology is clearly applied to the disguised Trojan on the client, the purpose is to prevent is antivirus anti-tracking Avira and is tracking to debug, but also to prevent the algorithm of the program is the others for static analysis. Used pe-scan t...
CVE-2007-1167
CVE-2007-1167 affects deV!L`z Clanportal (DZCP) prior to or including 1.4.5. The issue resides in inc/filebrowser/browser.php, where an attacker can trigger information disclosure by using the inc/mysql.php value of the file parameter, allowing remote retrieval of MySQL data. This is a remote, un...
DZCP (deV!L_z Clanportal) 1.4.5 - Remote File Disclosure
DZCP Devilz Clanportal = 1.4.5 Mysql Data viewable Found by: Kiba Solution: Install security Fix! Exploit: http://SITE/PATH/inc/filebrowser/browser.php?file=inc/mysql.php Example: http://www.example.com/dzcp/inc/filebrowser/browser.php?file=inc/mysql.php milw0rm.com 2007-02-21...
CVE-2006-6339
SQL injection vulnerability in sites/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request...
CVE-2006-6339
The CVE-2006-6339 entry describes an SQL injection in deV!L`z Clanportal (DZCP) prior to version 1.3.6.1, exploitable via the show parameter in a GET request. This allows remote attackers to execute arbitrary SQL commands. Affected software/function: sites/index.php in DZCP. Root cause: insuffici...