Photocart 3.9 - Multiple SQL Injections

Photocart 3.9 - Multiple SQL Injections Author: !DoktOR! Date found: 18.08.08 Product: PhotoCart Version: 3.9 возможно и более ранние версии Type: Photography Shopping Cart URL: www.picturespro.com Vulnerability Class: SQL Injection /installdir/search.php Vuln code: PHP:...

Discuz! Forum the wap function module coding injection vulnerability-vulnerability warning-the black bar safety net

Author: The Frozen prodigal son Due to the hair in a blog on the vulnerability information to a bit beef up. Official has out patch. Since PHP for multibyte character sets support the existence of problem in various coding conversion process, it is possible to initiate a program overflow and...

Discuz!论坛wap功能模块编码的注射漏洞

Discuz!论坛系统是一个采用 PHP 和 MySQL 等其他多种数据库构建的高效论坛解决方案。Discuz! 在代码质量，运行效率，负载能力，安全等级，功能可操控性和权限严密性等方面都在广大用户中有良好的口碑 由于 PHP 对 多字节字符集的支持存在问题，在各种编码相互转换过程中，有可能引发程序溢出和程序错误 提交一个 ' 转意成 ' 然后转成gbk的，\和'就变成两个字符了 '就可以成功的引入 Discuz!4.0.0 Discuz!4.1.0 Discuz!5.0.0 Discuz!5.5.0 Discuz!6.0.0 Discuz!6.1.0...

GLSA-200807-15 : Pan: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200807-15 Pan: User-assisted execution of arbitrary code Pavel Polischouk reported a boundary error in the PartsBatch class when processing .nzb files. Impact : A remote attacker could entice a user to open a specially crafted .nz...

CVE-2008-3242

The vulnerability affects the PPMate 2.3.1.93 package, specifically the PPMedia Class ActiveX control in PPMPlayer.dll. A heap-based buffer overflow can be triggered by a long argument to the StartUrl method, enabling remote attackers to execute arbitrary code. Affected component: PPMedia ActiveX...

新浪DLoader Class ActiveX控件任意文件下载漏洞

知道安全于近期捕获该漏洞的利用代码,在7月份网络上已经出现利用此漏洞的攻击代码.可导致用户在访问到黑客构造的攻击网页后,可能将恶意文件下载到系统安装,并且随着系统启动而执行. Sina UC 目前厂商已经发布新浪网络电视修复版本并且进行强制升级.请用户及时更新软件. UC的用户请继续关注http://www.51uc.com/进行更新. 也可以为clsid：78ABDC59-D8E7-44D3-9A76-9A0918C52B4A设置kill bit. Windows Registry Editor Version 5.00...

PPMate PPMedia Class ActiveX Control Buffer Overflow PoC

No description provided by source. html body object id=target classid=clsid:72B15B25-2EC8-4CDD-B284-C89A5F8E8D5F/object script language=vbscript arg1=String10000, "A" target.StartURLarg1 /script /body /html...

PPMate PPMedia Class ActiveX控件远程堆溢出漏洞

BUGTRAQ ID: 30246 PPMate网络电视是一款用于互联网上大规模视频直播的软件。 PPMate所安装的PPMedia Class ActiveX控件（PPMPlayer.dll）没有正确地处理传送给StartUrl方式的输入，如果用户受骗访问了恶意网页并向该方式传送了超长字符串的话，就会触发堆溢出，导致执行任意指令。 PPMate 2.3.1.93 PPMate ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.ppmate.com/...

pcre regular expression flaws

Perl-Compatible Regular Expression PCRE library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code...

[Full-disclosure] #2008-007 libpoppler uninitialized pointer - POC

hi. I was in doubt about releasing this because of there is no official patch. I suppose at this point anyone could accomplish the same thing so, again I'm in doubt. A friend once told me that if in doubt take your pants off. I've already tried that and I didn't earn no resolution to my conflict...

Directory traversal

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909...

CVE-2008-3112

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909...

CVE-2008-3112

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909...

CVE-2008-3112

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909...

[oCERT-2008-007] libpoppler uninitialized pointer

2008/07/07 2008-007 libpoppler uninitialized pointer Description: The poppler PDF rendering library suffers a memory management bug which leads to arbitrary code execution. The vulnerability is present in the Page class constructor/destructor. The pageWidgets object is not initialized in the Page...

CVE-2007-3652

SQL injection vulnerability in class/page.php in Farsi Script aka FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this might be the same issue as CVE-2008-0328...

Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution

Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution Felipe Andres Manzano [email protected] updates in http://felipe.andres.manzano.googlepages.com/home ''' Sumary: ======= The libpoppler pdf rendering library, can free uninitialized pointers, leading to arbitrary code...

poppler -- uninitialized pointer

Felipe Andres Manzano reports: The libpoppler pdf rendering library, can free uninitialized pointers, leading to arbitrary code execution. This vulnerability results from memory management bugs in the Page class constructor/destructor...

CMailServer 5.4.6 (CMailCOM.dll) Remote SEH Overwrite Exploit

Exploit for unknown platform in category remote exploits ============================================================= CMailServer 5.4.6 CMailCOM.dll Remote SEH Overwrite Exploit ============================================================= 0 strUID = arrStringi...

Youngzsoft CMailServer 5.4.6 - CMailCOM.dll Remote Overwrite (SEH)

Youngzsoft CMailServer 5.4.6 - CMailCOM.dll Remote Overwrite SEH 0 strUID = arrStringi objPOP3.MoveToFolder strUID ' ---------------- bof ... By attaching olly to the w3wp.exe sub-process you will see the usual dump with ecx and eip owned, with a buffer of approxymately 13000 chars...