Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability

Exploit for multiple platform in category remote exploits ============================================================= Apache Tomcat 5.5.17 Remote Directory Listing Vulnerability ============================================================= ScanAlert Security Advisory - http://www.scanalert.com...

Authentication flaw

publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and...

CVE-2006-1292

CVE-2006-1292 is a directory-traversal vulnerability in PHP iCalendar 2.21 and earlier. An attacker can cause local file inclusion and remote code execution by manipulating cookies phpicalendar[cookie_language] and phpicalendar[cookie_style] (with a NUL/%00) so that PHP sequences injected into an...

Code injection

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

Directory traversal

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...

Sql injection

SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets...

CVE-2006-1118

SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets...

CVE-2006-1118

The CVE-2006-1118 entry concerns an SQL injection vulnerability in the mail application bmail prior to Aardvark PR9.1 . The underlying issue is an input/construct flaw that allows remote attackers to execute arbitrary SQL commands via vectors involving the GBK character set. Impact is described a...

[SA19147] bMail GBK Charsets SQL Injection Vulnerability

TITLE: bMail GBK Charsets SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19147 VERIFY ADVISORY: http://secunia.com/advisories/19147/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: bMail 9.x http://secunia.com/product/8584/ DESCRIPTION: A vulnerability...

Moderate: Red Hat Security Advisory: mailman security update

An updated mailman package that fixes two security issues is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mailman is software to help manage email discussion lists. A flaw in handling of UT...

CVE-2006-0903

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysqlrealquery function. NOTE: this issue was originally reported for the mysqlquery function, but the vendor states that since mysqlquer...

Design/Logic Flaw

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysqlrealquery function. NOTE: this issue was originally reported for the mysqlquery function, but the vendor states that since mysqlquer...

CVE-2006-0903

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysqlrealquery function. NOTE: this issue was originally reported for the mysqlquery function, but the vendor states that since mysqlquer...

Code injection

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile before 0.22.4 allows remote attackers to cause a denial of service application crash via unspecified vectors involving character sets within e-mail messages...

CVE-2006-0876

POPFile (a Bayesian mail classifier) is affected by CVE-2006-0876: versions before 0.22.4 can be forced to crash (denial of service) via unspecified vectors involving character sets in email messages. The Debian advisory notes fixes in 0.22.2-2sarge1 (stable update) and 0.22.4-1 (unstable), and r...