[SECURITY] [DSA 1624-1] New libxslt packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1624-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 31, 2008 http://www.debian.org/security/faq -...

Afuse afuse.c文件Shell命令注入漏洞

BUGTRAQ ID: 30245 CVECAN ID: CVE-2008-2232 Afuse是使用FUSE在用户域实现的自动加载文件系统。 Afuse没有正确地过滤文件名便将其用在了system调用中。如果能够读访问afuse文件系统的攻击者使用了类似于以下的路径的话： /path/";arbitrary command;" /path/arbitrary command 则从注册为Afuse加载的目录请求上述特制文件就会导致以提升的权限执行任意命令。 Jacob Bower Afuse 0.2 Debian ------...

RedHat userhelper/PAM安全漏洞

RedHat 6.0和6.1系统中缺省安装的userhelper和PAM允许使用包含".."的路径名,并且 userhelper被设置了suid root位.因此本地用户可能获得root权限. userhleper允许你通过"-w"参数指定一个要运行的程序,这些程序需要在 /etc/security/console.apps目录里有一个对应文件.因此,通过指定类似"../../../ tmp/myprog"的程序名,攻击者可以利用userhelper去执行 "/etc/security/console.apps/../../../tmp/myprog",也就是执行"/tmp/myprog...

Debian 2.1 apcd符号链接漏洞

和Debian GNT/Linux 2.1一起发行的apcd软件包存在符号链接漏洞。当apcd进程接收到一个SIGUSR1信号时，会将其状态信息保存到/tmp/upsstat。然而由于这个文件没有被安全地打开，可能会导致符号链接攻击。 Debian GNU/Linux 2.1 该漏洞在0.6a.nr-4slink1版本中被修补，建议立刻升级apcd软件包。 Source archives: http://security.debian.org/dists/stable/updates/source/apcd0.6a.nr-4slink1.diff.gz MD5 checksum:...

CVE-2008-3131

SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter...

CVE-2008-3131

CVE-2008-3131 affects pSys 0.7.0 Alpha, specifically the chatbox.php component. The vulnerability is a SQL injection triggered when magic_quotes_gpc is disabled, allowing remote attackers to execute arbitrary SQL commands via the showid parameter. The root cause is improper handling of user-suppl...

CVE-2008-3131

SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter...

phnews-lfi.txt

┌┌───────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐...

pHNews CMS Multiple Local File Inclusion Vulnerabilities

No description provided by source. ┌┌───────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rise...

pHNews CMS Alpha 1 - Local File Inclusion

pHNews CMS Alpha 1 - Local File Inclusion ??????????????????????????????????????????????????????????????????????????????? ?? C r a C k E r ?? ?? T H E C R A C K O F E T E R N A L M I G H T ?? ?????????????????????????????????????????????????????????????????????????????? ????? From The Ashes and...

pHNews CMS Alpha 1 - Local File Inclusion

??????????????????????????????????????????????????????????????????????????????? ?? C r a C k E r ?? ?? T H E C R A C K O F E T E R N A L M I G H T ?? ?????????????????????????????????????????????????????????????????????????????? ????? From The Ashes and Dust Rises An Unimaginable crack.... ?????...

The Rat CMS - viewarticle2.php?id SQL Injection

The Rat CMS - viewarticle2.php?id SQL Injection source: https://www.securityfocus.com/bid/29959/info The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data...

The Rat CMS - viewarticle.php Multiple Cross-Site Scripting Vulnerabilities

The Rat CMS - viewarticle.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/29959/info The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently...

The Rat CMS (SQL/XSS) Multiple Remote Vulnerabilities

========================================================== The Rat CMS SQL/XSS Multiple Remote Vulnerabilities ========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

theratcms-sqlxss.txt

========================================================== The Rat CMS SQL/XSS Multiple Remote Vulnerabilities ========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

The Rat CMS - viewarticle2.php?id Cross-Site Scripting

The Rat CMS - viewarticle2.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/29959/info The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied...

The Rat CMS - 'viewarticle.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/29959/info The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to...

mosxml-lfi.txt

┌┌───────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐...

X.Org X server RENDER扩展ProcRenderCreateCursor()拒绝服务漏洞

BUGTRAQ ID: 29665 CVECAN ID: CVE-2008-2361 Xorg X Server是多个厂商操作系统中所捆绑的X窗口系统显示服务器。 X.Org X Server的RENDER扩展中的ProcRenderCreateCursor函数在解析客户端请求时直接将请求中的值用于计算动态缓冲区的大小。这个计算中可能出现整数溢出，导致分配不充分的缓冲区和访问无效内存，X Server可能会崩溃。...

psys-sql.txt

pSys - 0.7.0. alpha shownews SQL Injection Bug by: h0yt3r Bug in here: if isset$REQUEST'shownews' && $REQUEST'shownews' != "" $sqlbefehl="Select titel from $tabnews Where id = '".intval$REQUEST'shownews'."'"; $gettitel = mysqlquery$sqlbefehl,$serverid; $news=mysqlfetcharray$gettitel; $pagetitle =...