thEngine 0.1 - Local File Inclusion

thEngine 0.1 - Local File Inclusion ============================================================================================= ============================================================================================= == @@@@@@@@ @@@@@@ @@@@@@@ @@ @@ @@@@@@ @@ @@ @@@@@@@@ @@@@@@ == ==...

TaskFreak! loadByKey() SQL Injection

The version of TaskFreak installed on the remote host includes a version of the Tirzen Framework that fails to sanitize input to the 'loadByKey' function in the TznDbConnection class before using it in database queries. An unauthenticated, remote attacker can leverage this issue to launch a SQL...

VulnCheck KEV: CVE-2008-1490

Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo aka Pizco and possibly other online services, allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long Action property, a different CLSID than...

[SECURITY] Fedora 11 Update: sip-4.10.1-2.fc11

SIP is a tool for generating bindings for C++ classes so that they can be accessed as normal Python classes. SIP takes many of its ideas from SWIG bu t, because it is specifically designed for C++ and Python, is able to generate tighter bindings. SIP is so called because it is a small SWIG. SIP w...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 admin/menu.php and 2 library/lib.menu.php; and the adminroot parameter to 3...

OpenJDK No ClassCastException for HashAttributeSet constructors if run with -Xcomp (6894807)

Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

Zabbix 1.8.1 - SQL Injection

Zabbix 1.8.1 - SQL Injection ============================================= - Release date: April 1st, 2010 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- Zabbix = 1.8.1 SQL Injection II. BACKGROUND...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in surgeftpmgr.cgi in NetWin SurgeFTP 2.3a6 allow remote attackers to inject arbitrary web script or HTML via the 1 domainid or 2 classid parameter in a class action...

[SECURITY] Fedora 13 Update: gnu-smalltalk-3.1-8.fc13

GNU Smalltalk is an implementation that closely follows the Smalltalk-80 language as described in the book Smalltalk-80: the Language and its Implementation' by Adele Goldberg and David Robson. The Smalltalk programming language is an object oriented programming language. Unlike other Smalltalks...

JAD java Decompiler 1.5.8g - .class Stack Overflow Denial of Service

JAD java Decompiler 1.5.8g - .class Stack Overflow Denial of Service !/usr/bin/env python JAD java decompiler 1.5.8g .class Stack Overflow DoS Tested on Windows Software Link: http://www.varaneckas.com/jad Author: l3D Site: http://xraysecurity.blogspot.com IRC: irc://irc.nix.co.il Email:...

MySITES3. 0 site navigation system remote include vulnerability-vulnerability warning-the black bar safety net

Because the function is not initialized, leading to function can be any of the included files; 1, The registerglobal=On 2, The allowurlfopen = On 然后 即可 包含 Poc:www.r0expeR.Net/index.php?pathdir=http://www.r0expeR.Net/xx.txt ? php $poc = $GET'pathdir'; echo requireonce$poc; poc:http://www. r0expeR...

Oracle Database DBMS_JVM_EXP_PERMS IMPORT_JVM_PERMS privilege elevation

Added: 02/26/2010 BID: 38115 OSVDB: 62184 Background Oracle Database embeds a Java runtime environment called OracleJVM. The DBMSJVMEXPPERMS package is included in Oracle Database and is used for importing and exporting Java permissions between database servers. Problem A privilege elevation...

jQuery uploadify v2.1.0 Remote File Upload

No description provided by source. Exploit Title: jQuery uploadify v2.1.0 Remote File Upload Date: 21/01/2010 Author: k4cp3r/Ablus Version: v2.1.0 uploadify.swf Actionscript: function setAllowedTypes:void allowedTypes = ; if param.fileDesc && param.fileExt var fileDescs:Array =...

jQuery Uploadify 2.1.0 - Arbitrary File Upload

jQuery Uploadify 2.1.0 - Arbitrary File Upload Exploit Title: jQuery uploadify v2.1.0 Remote File Upload Date: 21/01/2010 Author: k4cp3r/Ablus Version: v2.1.0 uploadify.swf Actionscript: function setAllowedTypes:void allowedTypes = ; if param.fileDesc && param.fileExt var fileDescs:Array =...

jQuery uploadify v2.1.0 Remote File Upload

Exploit for unknown platform in category web applications ========================================== jQuery uploadify v2.1.0 Remote File Upload ========================================== Exploit Title: jQuery uploadify v2.1.0 Remote File Upload Date: 21/01/2010 Author: k4cp3r/Ablus Version: v2.1....

SA-CONTRIB-2010-009 - Block Class - Cross Site Scripting

Block Class module allows users to add classes to any block through the block's configuration interface. This release includes a fix for a cross-site scripting XSS vulnerability through which JavaScript could be inserted in the class field of a block's configuration interface. Versions affected...

CVE-2008-7252

libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors...

TrendMicro Web-Deployment Active-X Remote Execution

param NAME="YvVSW"...

XSS Vulnerability in Active Calendar 1.2.0

XSS Vulnerability in Active Calendar 1.2.0 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Active Calendar is PHP Class, that generates calendars year, month or week view as a HTML Table XHTML-Valid. From:...

Active Calendar 1.2.0 Cross Site Scripting

XSS Vulnerability in Active Calendar 1.2.0 Discovered by Martin Barbella Description of Vulnerability: ----------------------------- Active Calendar is PHP Class, that generates calendars year, month or week view as a HTML Table XHTML-Valid. From: http://micronetwork.de/activecalendar/index.php I...