CVE-2010-4677

emWEB on Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.23 allows remote attackers to cause a denial of service daemon crash via a request for a document whose name contains space characters, aka Bug ID CSCsy08416...

SSH password weakness

Added: 01/05/2011 CVE: CVE-1999-0502 Background Passwords are the most commonly used method of authenticating users to a server. The combination of a login name and password is used to verify the identity of a user requesting access, and to determine what parts of the server the user has permissi...

SQL injection authentication bypass

Added: 01/04/2011 Background Structured Query Language SQL is the most common language understood by modern relational databases. Problem A web program uses input parameters within an SQL query in an unsafe manner. This could allow a remote attacker to manipulate the authentication query via a...

Cisco Unified Communications Manager shell characters vulnerability

Shell characters vulnerability in /usr/local/cm/bin/pktCapprotectData suid binary...

Zeeways Adserver Cross Site Request Forgery / SQL Injection

Exploit Title: Zeeways Adserver Multiple Vulnerabilities Date: 06.11.2010 Author: Valentin Category: webapps/0day Version: Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = Zeeways Adserver Multip...

Oracle Sun Java System Web Server - HTTP Response Splitting

Exploit for jsp platform in category web applications =========================================================== Oracle Sun Java System Web Server - HTTP Response Splitting =========================================================== Description Security-Assessment.com discovered that is possible...

Oracle Sun Java System Web Server - HTTP Response Splitting

Oracle Sun Java System Web Server - HTTP Response Splitting Description Security-Assessment.com discovered that is possible to successfully perform an HTTP Response Splitting attack against applications served by Sun Java System Web Server. The vulnerability can be exploited if user supplied inpu...

printf(1) via PHP magic_quotes Utility Command Encoder

This encoder uses the printf1 utility to avoid restricted characters. Some shell variable substitution may also be used if needed symbols are blacklisted. Some characters are intentionally left unescaped since it is assumed that PHP with magicquotesgpc enabled will escape them during request...

PT-2010-4736 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 8 Description: The issue allows remote attackers to obtain sensitive information from a different domain or zone via a crafted web site. An information disclosure vulnerability exists in the way...

Microsoft Internet Explorer Multiple Vulnerabilities (2360131)

This host is missing a critical security update according to Microsoft Bulletin MS10-071. OpenVAS Vulnerability Test $Id: secpodms10-071.nasl 6527 2017-07-05 05:56:34Z cfischer $ Microsoft Internet Explorer Multiple Vulnerabilities 2360131 Authors: Sooraj KS Copyright: Copyright c 2010 SecPod,...

AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)

This module exploits a stack buffer overflow in AASync v2.2.1.0, triggered when processing the response on a LIST command. During the overflow, a structured exception handler record gets overwritten. Module Options msf use exploit/windows/ftp/aasync/listreply msf undefinedlistreply show actions...

Internet Explorer CSS Special Character Information Disclosure (MS10-071; CVE-2010-3325)

CSS Cascading Style Sheets is a formatting method for Web pages using HTML. An information disclosure vulnerability has been reported in the way Microsoft Internet Explorer processes CSS special characters. The vulnerability is due to the way Internet Explorer improperly process CSS special...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6563)

This update brings the Mozilla Firefox 3.5 webbrowser to version 3.5.3, the Mozilla XULRunner 1.9.0 engine to the 1.9.0.14 stable release, and the Mozilla XULRunner 1.9.1 engine to the 1.9.1.3 stable release. It also fixes various security issues : - Mozilla developers and community members...

SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)

w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates CVE-2010-2074. This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable Network...

E-Xoopport Samsara 3.1 (eCal Module) - Blind SQL Injection

!/usr/bin/perl 0-Day E-Xoopport - Samsara \r\n"; exit; my $host = $ARGV0; my $usr = $ARGV1; my $pwd = $ARGV2; my $anickde = $ARGV3; my $anick = '0x'.EncHex$anickde; print "! Logging In...\r\n"; my %postdata = uname = "$usr", pass = "$pwd", op = "login" ; my $cookies = HTTP::Cookies-new autosave =...

Novell PlateSpin Orchestrate shell characters vulnerability

Shell characters vulnerability on graphs rendering...

Microsoft full system, The establishment of hidden accounts vulnerability-vulnerability warning-the black bar safety net

Publishing author: onlyguest Affected version: Microsoft series Official address: www.microsft.com Vulnerability type: design error Vulnerability Description: by special characters, the establishment of hidden accounts. The command line interface is not displayed,the user management panel in the...

smbind 0.4.7 - SQL Injection

smbind query"SELECT ID FROM users WHERE username = '" . $SESSION'username' ."' AND password = '" . md5$SESSION'password' . " ' "; Easy admin login Enter in username field: admin'; Enter in password field: anything Sql query will result like this: SELECT ID FROM users WHERE username = 'admin'; ' A...

Joomla Lesson SQL Injection

Joomla Component lesson SQL Injection Vulnerability Author : Fl0riX Bug Researchers Greez: Sakkure-Kedesign And All My Friends Name : Joomla Comlesson Bug Type : SQL injection Infection : Admin Login Bilgileri Alinabilir. Demo Vuln : http://www.musiccomm.com/index.php?option=comlesson&id=EXPLOIT...

CVE-2010-2813

functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to the creation of many preferences file...