9911 matches found
Apache suEXEC - Information Disclosure / Privilege Escalation
Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web server. Normally, when a CGI or SSI program executes, it runs as...
Sybase EAServer XML External Entity (XXE) Arbitrary File Disclosure
The remote Sybase EAServer install is affected by an arbitrary file disclosure vulnerability. It is possible to view any file on the system by utilizing XML external entity injection in specially crafted XML data sent to the REST service on the remote host. Note that hosts that are affected by th...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Munin Resource Monitoring < 2.0.6 Multiple Vulnerabilities
Binary data 6948.prm...
Fedora 17 : php-5.4.17-2.fc17 (2013-12354)
04 Jul 2013, PHP 5.4.17 Core : - Fixed bug 64988 Class loading order affects ESTRICT warning. Laruence - Fixed bug 64966 segfault in zenddofcallcommonhelperSPEC. Laruence - Fixed bug 64960 Segfault in gczvalpossibleroot. Laruence - Fixed bug 64936 doc comments picked up from previous scanner run...
Fedora 18 : php-5.4.17-2.fc18 (2013-12315)
04 Jul 2013, PHP 5.4.17 Core : - Fixed bug 64988 Class loading order affects ESTRICT warning. Laruence - Fixed bug 64966 segfault in zenddofcallcommonhelperSPEC. Laruence - Fixed bug 64960 Segfault in gczvalpossibleroot. Laruence - Fixed bug 64936 doc comments picked up from previous scanner run...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Oracle Linux 4 : ruby (ELSA-2007-0961)
From Red Hat Security Advisory 2007:0961 : Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for...
Oracle Linux 5 : perl (ELSA-2011-1797)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1797 advisory. - CVE-2010-2761 CVE-2010-4410 perl: CGI module multiple issues fixed by security patch based on commit from version 3.50 - CVE-2010-2761 CVE-2010-4410...
Oracle Linux 3 : ruby (ELSA-2006-0729)
From Red Hat Security Advisory 2006:0729 : Updated ruby packages that fix a denial of service issue for the CGI instance are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for...
Cisco Prime Data Center Network Manager Web Detection
The web interface for Cisco Prime Data Center Network Manager DCNM was detected on the remote host. DCNM is used to manage virtualized data centers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid67246; scriptversion"1.10";...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
D-Link - OS-Command Injection via UPnP Interface
D-Link - OS-Command Injection via UPnP Interface Title: OS-Command Injection via UPnP SOAP Interface in multiple D-Link devices Vendor: D-Link Devices: DIR-300 rev B / DIR-600 rev B / DIR-645 / DIR-845 / DIR-865 ============ Vulnerable Firmware Releases: ============ DIR-300 rev B - 2.14b01 DIR-6...
Extmail /cgi/index.cgi SQL注入漏洞
No description provided by source...
FtpLocate 2.02 Cross Site Scripting Vulnerability
FtpLocate version 2.02 suffers from a persistent cross site scripting vulnerability. Exploit Title: FtpLocate 2.02 Persistent XSS Date: 2013/6/23 Exploit Author: Chako Firmware Version: 2.02 Tested on: Windows 7 Vendor Homepage: http://turtle.ee.ncku.edu.tw/ftplocate/readme.english.html...
FtpLocate 2.02 Cross Site Scripting
Exploit Title: FtpLocate 2.02 Persistent XSS Date: 2013/6/23 Exploit Author: Chako Firmware Version: 2.02 Tested on: Windows 7 Vendor Homepage: http://turtle.ee.ncku.edu.tw/ftplocate/readme.english.html http://www.freshports.org/ftp/ftplocate/ File Download:...
[SECURITY] Fedora 17 Update: php-5.4.16-1.fc17
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
Apache Struts 2 OGNL Expression Handling Double Evaluation Error Remote Command Execution
The remote web application appears to use Struts 2, a web framework that utilizes OGNL Object-Graph Navigation Language as an expression language. Due to a flaw in the evaluation of an OGNL expression, a remote, unauthenticated attacker can exploit this issue to execute arbitrary commands on the...
pykto
This plugin is a nikto port to python. It uses the scandatabase file from nikto to search for new and vulnerable URLs. The following configurable parameters exist: cgidirs admindirs nukedirs extradbfile mutatetests This plugin reads every line in the scandatabase and extradbfile and based on the...