1148 matches found
Zend Platform不安全文件访问权限漏洞
Zend Platform是企业级PHP应用的运行时平台环境。 Zend Platform的文件安装存在权限配置错误，本地攻击者可能利用此漏洞获取权限提升。 Zend Platform所安装的一些二进制程序和SHELL脚本没有设置安全的文件访问权限，导致Web服务器用户或安装Zend Platform的用户帐号错误地拥有了某些文件。如果入侵了Web服务器或安装Zend Platform的用户帐号的话，攻击者就可以通过替换或编辑文件获得权限提升，在下一次服务器重启时以root用户权限执行文件。 Zend Platform = 2.2.3 ----...
Multiple local Zend privilege escalations
Weak permissions for different files and utilities...
BONUS-07-2007:Zend Platform ini_modifier Local Root Vulnerability
Summary Zend Platform comes with an inimodifier that is used by the GUI to alter the php.ini file. By abusing a vulnerability within the inimodifier it is possible for a local attacker to edit the php.ini file without knowing the necessary GUI password. This can be used to obtain root privileges ...
BONUS-06-2007:Zend Platform Insecure File Permission Local Root Vulnerability
Summary Several binaries and shellscripts installed by the Zend Platform come with insecure file permissions. Certain files are incorrectly owned by the Web server user or owned by the user account, who installed the Zend Platform. By compromisng the web server account through for example one of...
Zend Platform 2.2.1 - PHP.INI File Modification
Zend Platform 2.2.1 - PHP.INI File Modification source: https://www.securityfocus.com/bid/22802/info The Zend Platform is prone to an issue that may let local attackers modify the PHP configuration file 'php.ini'. This issue occurs because the application is installed with an 'inimodifier' progra...
Zend Platform 2.2.1 - 'PHP.INI' File Modification
source: https://www.securityfocus.com/bid/22802/info The Zend Platform is prone to an issue that may let local attackers modify the PHP configuration file 'php.ini'. This issue occurs because the application is installed with an 'inimodifier' program that may be executed by local users and will...
security flaw
The zendhashinit function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service infinite loop by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a...
security flaw
The zendhashinit function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service infinite loop by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a...
security flaw
The zendhashinit function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service infinite loop by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a...
[PHP-DEV] PHP 5.2.1 crashing Apache/IIS...
Heads up! Installed the latest Win32 binaries of thread-safe PHP 5.2.1 on Win32 Apache and IIS. PHP started crashing definitely PHP - php5ts.dll when I went to access the MyProBB web forum. Win32 Apache flat out crashes, IIS bails with HTTP 500 errors. Forum crashes PHP 5.2.1:...
Debian DSA-1206-1 : php4 - several vulnerabilities
Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3353 Tim Starling discovered that missing...
CVE-2006-5900
Cross-site scripting XSS vulnerability in the incubator/tests/Zend/Http/files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters...
CVE-2006-5900
Cross-site scripting XSS vulnerability in the incubator/tests/Zend/Http/files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters...
CVE-2006-5900
The CVE-2006-5900 entry concerns a Cross-site scripting (XSS) vulnerability in Zend Framework Preview 0.2.0, specifically in the incubator/tests/Zend/Http/_files/testRedirections.php sample code. The issue arises because arbitrary parameters can be used to inject arbitrary web script or HTML. The...
CVE-2006-5900: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the incubator/tests/Zend/Http/files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters...
Armorize-ADV-2006-0009.txt
Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...
XSS Vulnerability in Zend Framework Preview 0.2.0
Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...
Zend平台多个远程漏洞
Zend Platform是企业级PHP应用的运行时平台环境。 Zend平台所捆绑的会话集群系统中存在多个漏洞，可能导致会话集群守护程序崩溃，会话函数无法工作，被攻击的节点拒绝服务。如果创建了特制的会话ID的话，攻击者还可以在会话集群守护程序的环境中或modcluster模块中执行任意代码。...
CVE-2006-5717: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Zend Google Data Client Library ZendGData Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 basedemo.php and 2 calenderdemo.php in samples/, and other unspecified files...
USN-362-1: PHP vulnerabilities
The stripos function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. CVE-2006-4485 An integer overflow was discovered in the PHP memory allocation handling. On...