WebAsys - Blind SQL Injection

".$res; if!pregmatch"/Subquery returns/", $result $res .= chr$j; break; echo $out; ifsubstrstrtolowerPHPOS,0,3 == 'win' system...

Password Manager Daemon二进制密钥文件不安全加密漏洞

BUGTRAQ ID: 39882 Password Manager Daemon是通过套接字向应用提供数据的守护程序。数据存储在加密的XML文件中，客户端在打开和保持文件时必须提供密钥。 应用以ASCII形式从指定的keyfile配置参数中读取数据，而用户可能使用文件中的二进制数据。如果二进制数据中包含有空字节或换行符的话，就会导致使用较弱的密钥。 Ben Kibbey Password Manager Daemon 2.13 厂商补丁： Ben Kibbey ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Easyzip 2000 v3.5 (.zip) 0day stack buffer overflow PoC exploit

Exploit for windows platform in category local exploits =============================================================== Easyzip 2000 v3.5 .zip 0day stack buffer overflow PoC exploit =============================================================== ?php / Easyzip 2000 v3.5 .zip 0day stack buffer...

Mocha LPD 1.9 - Remote Buffer Overflow (Denial of Service) (PoC)

!/usr/bin/python Mocha LPD v1.9 Remote Heap Overflow Exploit ol skool 'write 4' whoops, I said it was a DoS. My bad. btw yes, I know its 2010 :0 CVE: 2010-1687 tested on XP sp1 use anti debugging to see it work - !hidedebug zwqueryinformationprocess call trace: ntdll.RtlAllocateHeap Called...

RPM SelectElite 5.0 - .xml Configuration parsing Unicode Buffer Overflow (PoC)

RPM SelectElite 5.0 - .xml Configuration parsing Unicode Buffer Overflow PoC !/usr/bin/python RPM Select/Elite v5.0 .xml config parsing unicode buffer overflow PoC Found by: mrme - http://net-ninja.net/ Homepage: http://lpd.brooksnet.com/ Download: http://www.brooksnet.com/download-rpmselect Test...

phpscripte24 Vor und Rückwärts Auktions System - Blind SQL Injection

phpscripte24 Vor und Rückwärts Auktions System - Blind SQL Injection ----------------------------Information------------------------------------------------ +Name : phpscripte24 Vor und Rückwärts Auktions System Blind SQL Injection auktion.php +Autor : Easy Laster +Date : 02.04.2010 +Script :...

Profi Einzelgebots Auktions System - Blind SQL Injection

----------------------------Information------------------------------------------------ +Name : Profi Einzelgebots Auktions System 1 -----------------------------------------------------------------------------------------...

phpscripte24 Niedrig Gebote Pro Auktions System II - Blind SQL Injection

----------------------------Information------------------------------------------------ +Name : phpscripte24 Niedrig Gebote Pro Auktions System II Blind SQL Injection auktion.php +Autor : Easy Laster +Date : 18.03.2010 +Script : phpscripte24 Niedrig Gebote Pro Auktions System II +Download :...

PostNuke FormExpress Module - Blind SQL Injection

PostNuke FormExpress Module - Blind SQL Injection Date: 17/03/2010 Software Link: http://sourceforge.net/projects/pn-formexpress/ Version: 0.3.2 PostNuke ContentExpress Module Blind Sql Injection Reported by Sharif University of Technology CSIRT Vulnerability Analysis and Penetration Testing Grou...

jBCrypt library cryptographic vulnerability

non-ASCII characters are converted to '?' befor hash calculation...

Internet Explorer US-ASCII Charset Obfuscation (CVE-2006-3227)

Although various security products provide coverage against many web vulnerabilities, these known exploits could potentially bypass security products by using US-ASCII charset obfuscation techniques. Microsoft Internet Explorer contains a flaw related to the encoding Internet transmitted content...

CentOS 5 : enscript (CESA-2008:1016)

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GNU enscript converts ASCII files to PostScriptR language files and spools the...

Easy and sun Shopping Mall v1. 4Cookies injection vulnerability-vulnerability warning-the black bar safety net

Easy and sun Shopping Mall v1. 4Cookies injection vulnerability This injection vulnerability seems to occur in the Home Shopping system. Looks like the network fun. The problem occurs in getpwd4. asp page. See the code: % username=request"username" passwd=md5trimrequest. form"passwd",1 6 set...

CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

DEBIAN-CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

CVE-2009-4214

CVE-2009-4214 is an XSS vulnerability in Ruby on Rails via the strip_tags path. It affects Rails before 2.2.s and 2.3.x before 2.3.5, allowing remote attackers to inject arbitrary script/HTML using vectors involving non‑printing ASCII characters (related to HTML::Tokenizer and html/node.rb). Expl...

CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

CVE-2009-4214: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...