AllMyLinks Index.PHP远程文件包含漏洞

AllMyLinks是一款基于PHP的WEB应用程序。 AllMyLinks不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Index.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 AllMyPHP AllMyLinks 0.5 目前没有解决方案提供： http://www.php-resource.net/content-12.html...

PowerArchiver PAISO.DLL ISO文件处理缓冲区溢出漏洞

PowerArchiver是一款解压缩程序。 PowerArchiver处理ISO映象文件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于PAISO.DLL version 1.7.3.0中的LoadTree和ReadHeader函数中，LoadTree和ReadHeader函数通过读取ISO文件中的目录条目构建每个文件的完整路径名，从每个目录条目中读取的目录名使用lstrcatA进行合成，最后成为文件名，最后使用不安全lstrcpyA函数拷贝到固定长度的堆栈缓冲区溢出，精心构建ISO文件，诱使用户打开，可导致以应用程序进程权限执行任意指令。...

AWStats configdir Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework cla...

Cacti graph_view.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Raxnet Cacti 'graphview.php' script. All versions of Raxnet Cacti prior to 0.8.6-d are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

HP Openview connectedNodes.ovpl Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the HP OpenView connectedNodes.ovpl CGI application. The results of the command will be displayed to the screen. This module requires Metasploit: https://metasploit.com/download Current source:...

Barracuda IMG.PL Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Barracuda Spam Firewall appliance. Versions prior to 3.1.18 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...

TDiary未明远程代码执行漏洞

TDiary是一款类似WEBBLOG的日记软件。 TDiary存在一个未明安全问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 tDiary tDiary 2.0.3 tDiary tDiary 2.0.2 tDiary tDiary 2.0.1 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debi...

Ultimate PHP Board chat/login.php username Parameter Arbitrary Command Execution

The remote host is running Ultimate PHP Board UPB. The version of UPB installed on the remote host does not sanitize input to the 'username' parameter of the 'chat/login.php' script before writing it to 'chat/text.php'. Regardless of PHP's settings, an attacker can leverage this flaw to inject...

Microsoft Office for Mac未明安全漏洞

Microsoft Office for Mac是一款微软开发的使用在苹果系统上的办公软件。 Microsoft Office for Mac存在未明错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 Microsoft Office X for Mac 0 Microsoft Office 2004 for Mac 0 目前没有详细解决方案提供： http://www.microsoft.com/mac/products/office2004/office2004.aspx?pid=office2004...

CVE-2006-6678

The edittextarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename...

TYPO3 'spell-check-logic.php' 'userUid' Parameter Arbitrary Command Execution

The remote host is running TYPO3, an open source content management system written in PHP. The version of TYPO3 installed on the remote host fails to sanitize user-supplied input to the 'userUid' parameter before using it in the 'spell-check-logic.php' script to execute a command. An...

Invisionix Roaming System Remote Pageheaderdefault.Inc.PHP远程文件包含漏洞

Invisionix Roaming System是一款基于PHP的WEB应用程序。 Invisionix Roaming System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'Pageheaderdefault.Inc.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Invisionix Systems Invisionix Roaming System Remote 0.2 http://www.invisionix.org/...

Joomla X-shop远程文件包含漏洞

Joomla X-shop是一款基于PHP的电子购物程序。 Joomla X-shop不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Joomla X-Shop 1.7 http://mamboxchange.com/projects/x-shop/...

CVE-2006-6289

Woltlab Burning Board wBB Lite 1.0.2 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the wbbuserid parameter to the top-level URI...

CVE-2006-6244

Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 is vulnerable to arbitrary command execution via shell metacharacters in CALLERID(name) or CALLERID(number). Root cause: improper handling of shell metacharacters in these fields. The available sources document this ...

CVE-2006-5957

INFINICART is affected by multiple SQL injection vulnerabilities reported as CVE-2006-5957. Public details specify that remote attackers could manipulate SQL by supplying crafted input in the following parameters: groupid (browse_group.asp), productid (added_to_cart.asp), and catid/subid (browses...

Oracle Security Component sys.pbsde buffer overflow

Added: 11/07/2006 CVE: CVE-2005-3438 BID: 15134 OSVDB: 20612 Background pbsde is a package of stored procedures which is part of the base installation of Oracle Database. Problem A buffer overflow in the sys.pbsde.init procedure allows database users to execute arbitrary commands. Resolution Appl...

eIQNetworks Enterprise Security Analyzer Monitoring.exe多个缓冲区溢出漏洞

eIQnetworks Enterprise Security Analyzer（ESA）是一款企业级的安全管理平台。 ESA的Monitoring.exe进程中存在两个缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 第一个漏洞存在于Monitoring.exe中负责处理TCP 9999端口上用户数据的例程中。如果连接到这个端口，用户就会立即被提示输入口令。这时可以发送HELP命令获得各种命令帮助： --------------------------------------------------------- Usage: QUERYMONITOR: to fetc...

Serv-U FTP Server MDTM timezone buffer overflow

Added: 10/27/2006 CVE: CVE-2004-0330 BID: 9751 OSVDB: 4073 Background Serv-U FTP Server supports the MDTM command which allows users to modify the time stamp on files. Problem A buffer overflow in Serv-U FTP Server allows remote authenticated attackers to execute arbitrary commands by sending the...

Ingo Foldername Arbitrary Command Execution

According to its version number, the instance of Ingo installed on the remote host fails to properly sanitize mailbox destinations in filter rules. By using a folder name beginning with '|' as a mailbox destination, an authenticated, remote attacker may be able to exploit this issue to execute...