PostgreSQL 'xslt_process()'任意文件创建或覆盖漏洞

Bugtraq ID:55072 CVE ID: CVE-2012-3488 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL解析XSLT样式表时"xsltprocess"函数存在错误，允许攻击者利用漏洞创建或覆盖任意文件。 0 PostgreSQL 8.x PostgreSQL 9.x 厂商解决方案 PostgreSQL 9.1.5, 9.0.9, 8.4.13或8.3.20已经修复此漏洞，建议用户下载使用： http://www.postgresql.org...

php: XSLT file writing vulnerability

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

CVE-2012-0057

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

Oracle AutoVue AutoVueX ActiveX Control Export3DBom Remote File Creation

An arbitrary file creation vulnerability has been reported in Oracle AutoVue ActiveX control...

HP Managed Printing Administration jobDelivery Multiple Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Managed Printing Administration. Authentication is not required to exploit this vulnerability. There multiple classes of flaws within this product including arbitrary file creation, null char...

BroadWin Webaccess SCADAHMI Client - Remote Code Execution

BroadWin Webaccess SCADAHMI Client - Remote Code Execution BroadWin WebAccess SCADA/HMI Remote Code Execution Vulnerability 0day WebAccess is the first fully web browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. bwocxrun.ocx Activ...

Design/Logic Flaw

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

Novell ZENworks Handheld Management Common.dll messageID Request Field Parsing Traversal Arbitrary File Creation

The version of the 'Common.dll' library included with the ZENworks Handheld Management install on the remote Windows host is affected by a directory traversal vulnerability because it fails to sanitize user input to the 'messageID' field in requests of directory traversal sequences. An...

Apple Safari Webkit - libxslt Arbitrary File Creation (Metasploit)

$Id: safarixsltoutput.rb 13987 2011-10-18 07:39:50Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CentOS Update for xmlsec1 CESA-2011:0486 centos5 i386

Check for the Version of xmlsec1 OpenVAS Vulnerability Test CentOS Update for xmlsec1 CESA-2011:0486 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

HP Intelligent Management Center TFTP Multiple Vulnerabilities

A TFTP server belonging to HP Intelligent Management Center is running on the remote host. This is a collection point for any HP Intelligent Management Center clients on the network. The installed version of this server contains a number of vulnerabilities, including code execution and arbitrary...

HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities

According to its version number, the HP Intelligent Management Center install on the remote host is potentially affected by multiple vulnerabilities : - A stack-based buffer overflow vulnerability exists in the 'img.exe' component. CVE-2011-1848 - A flaw exists in the 'tftpserver.exe' component...

HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities

Binary data 5927.prm...

ZDI-11-161: HP 3COM/H3C Intelligent Management Center tftpserver WRQ Remote Code Execution Vulnerability

ZDI-11-161: HP 3COM/H3C Intelligent Management Center tftpserver WRQ Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-161 May 10, 2011 -- CVE ID: CVE-2011-1849 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard -- Affected Products:...

xmlsec1: arbitrary file creation when verifying signatures

xslt.c in XML Security Library aka xmlsec before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification...

Easy File Sharing Web Server 5.8 Multiple Vulnerabilities

Exploit for windows platform in category remote exploits ------------------------------------------------------------------------ Software................Easy File Sharing Web Server Version 5.8 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5...

Easy File Sharing Web Server 5.8 Directory Traversal

------------------------------------------------------------------------ Software................Easy File Sharing Web Server Version 5.8 Vulnerability...........Directory Traversal / Arbitrary File Creation Threat Level............Very Critical 5/5...

Easy File Sharing Web Server 5.8 - Multiple Vulnerabilities

Easy File Sharing Web Server 5.8 - Multiple Vulnerabilities ------------------------------------------------------------------------ Software................Easy File Sharing Web Server Version 5.8 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5...

Easy File Sharing Web Server 5.8 - Multiple Vulnerabilities

------------------------------------------------------------------------ Software................Easy File Sharing Web Server Version 5.8 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5 Download................http://www.sharing-file.com/ Disclosure...

Medium severity flaw in QNX Neutrino RTOS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory NDSA20110310 Date: 10th March 2011 Author: Tim Brown mailto:[email protected] URL: http://www.nth-dimension.org.uk/ / http://www.machine.org.uk/ Product: QNX Neutrino RTOS 6.5.0...