VMware ESX多个信息泄露漏洞

VMWare ESX Server是一款虚拟主机的服务程序。 VMWare ESX Server存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息。 VMWare ESX Server包含的管理接口是传统的WEB应用程序，使用的会话ID包含在两个COOKIE中（vmware.mui.kid和vmware.mui.sid），这会话ID格式包含BASE64编码的用户帐户和密码，如果攻击者可以通过其他机制访问COOKIE，就可以获得验证信息。 另外管理接口还提供更改密码的功能，通过HTML表单，用户需要输入和确定新的密码，如更改ROOT用户的密码为"test"，就需要如下请求：...

MailEnable SMTP NTLM认证多个安全漏洞

MailEnable是一款商业性质的POP3和SMTP服务器。 MailEnable的NTLM认证过程中SMTP连接器存在3个预认证漏洞。 1. 在处理NTLM Type1消息的签名字段时存在缓冲区溢出，可能导致执行任意代码； 2. 在处理base64编码的NTLM Type1消息中安全缓冲区时存在越界读取，可能导致拒绝服务； 3. 在Type3消息的base64编码过程中存在越界读取，可能导致执行任意代码。 MailEnable MailEnable Professional 2.0 MailEnable MailEnable Enterprise 2.0...

CVE-2006-5617

Directory traversal vulnerability in index.php in Thepeak File Upload Manager 1.3 allows remote attackers to read or download arbitrary files via a base64-encoded file path containing a .. dot dot sequence in the file parameter...

CVE-2006-5617

The CVE-2006-5617 entry concerns Thepeak File Upload Manager 1.3. Affected component: index.php, where directory traversal can be achieved via a base64-encoded file parameter containing ".." to read or download arbitrary files. Documented impact is partial confidentiality and potential file acces...

TIBCO Rendezvous <= 7.4.11 Password Extractor Local Exploit

No description provided by source. / Exploit: TIBCO RendezVous local password extractor version =7.4.11 Affected products: Tibco RendezOVous version =7.4.11 Author: Andres Tarasco Acua atarasco @ sia.es Advisory: http://www.514.es Status: Vendor notifification Timeline: ---------------- Discovere...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

SMF-xss.txt

title: Simple Machines Forum SMF XSS issue author: Jose Carlos Norte discovered by: Jose Carlos Norte 1. introduction Simple machines forum is a popular scalable free bulletin board system written in php over mysql database, the url of the project: http://www.simplemachines.org/ 2. XSS problem SM...

CVE-2006-4676

TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file...

CVE-2006-4676

TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file...

TIBCO Rendezvous <= 7.4.11 Password Extractor Local Exploit

Exploit for unknown platform in category local exploits =========================================================== TIBCO Rendezvous tibco.exe c:\rvrd.db Tibco RendezVous Password Dumper Affected versions =v7.4.11 Author: Andres Tarasco atarasco @ sia.es Url: http://www.514.es + Tibco Logfile...

TIBCO Rendezvous 7.4.11 - Password Extractor

TIBCO Rendezvous 7.4.11 - Password Extractor / Exploit: TIBCO RendezVous local password extractor version tibco.exe c:\rvrd.db Tibco RendezVous Password Dumper Affected versions include define DECODE64c isasciic ? base64valc : -1...

TIBCO Rendezvous 7.4.11 - Password Extractor

/ Exploit: TIBCO RendezVous local password extractor version tibco.exe c:\rvrd.db Tibco RendezVous Password Dumper Affected versions include define DECODE64c isasciic ? base64valc : -1 static const char base64val = -1, -...

(seamonkey): DOS/arbitrary code execution vuln with vcards

Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service hang and possibly execute arbitrary code via a VCard that contains invalid base64 characters...

security flaw

Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service crash via a VCard attachment with a malformed base64 field, which copies more data than expected due to an integer underflow...

DEBIAN-CVE-2006-3804

Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service crash via a VCard attachment with a malformed base64 field, which copies more data than expected due to an integer underflow...

(seamonkey): DOS/arbitrary code execution vuln with vcards

Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service hang and possibly execute arbitrary code via a VCard that contains invalid base64 characters...

Freeze Greetings Cards PWD.txt

SOFTWARE: ========= Freeze Greetings http://www.scriptsez.net/ DESCRIPTION: ============ google dork = "Powered by Freeze Greetings" default password path http://www.site.com/freeze or path/PWD.txt pwd file's password is encode the base64. pwd encode the base64 cracker and login to...

CVE-2006-3006

Cross-site scripting XSS vulnerability in iFoto 0.20, and possibly other versions before 0.50, allows remote attackers to inject arbitrary HTML or web script via a base64-encoded file parameter...

CVE-2006-3006

Cross-site scripting XSS vulnerability in iFoto 0.20, and possibly other versions before 0.50, allows remote attackers to inject arbitrary HTML or web script via a base64-encoded file parameter...

iFoto v0.20-06/06/06

iFoto v0.20-06/06/06 Homepage: http://ifoto.ireans.com/ Effected files: XSS Vulnerability: The dir path to show the image is base 64 encoded, so to attempt this XSS example we encode our codein base64. The code we'll be using is javascript in an iframe tag. IFRAME...