Sun Java Web Start Plugin Command Line Argument Injection

This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. The arguments passed to Java Web Start are not properly validated, allowing injection of arbitrary arguments to the JVM. By utilizing the lesser known -J option, an attacker can take advantage of the...

Oracle Java Web Start JNLP Double Quote Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Webstart. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within javaws.exe...

PHP Calendar Extension “SdnToJulian()”远程整数溢出漏洞

BUGTRAQ ID: 46967 CVE ID: CVE-2011-1466 PHP是一种在电脑上运行的脚本语言，主要用途是在于处理动态网页，包含了命令行运行接口或者产生图形用户界面程序。 PHP 5.3.6之前版本的Calendar扩展中的SdnToJulian函数在实现上存在整数溢出漏洞，可使攻击者通过calfromjd函数的首个参数造成拒绝服务 0 PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...

[SECURITY] Fedora 15 Update: curl-7.21.3-13.fc15

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

DNS domain transfer disclosure vulnerability details-vulnerability warning-the black bar safety net

The zone transfer operation refers to a backup server to use from the main server's data to refresh their zone database. This is running the DNS service provides a certain degree of redundancy, its purpose is to prevent the primary domain name server due to an unexpected fault becomes unavailable...

Juniper Junos MGD-CLI Arbitrary Command Execution (PSN-2011-11-418)

According to its self-reported version number, the version of Junos running on the remote device has a command execution vulnerability. A flaw in the logical model governing inter-process communications between the management daemon MGD and the command-line interpreter CLI could result in arbitra...

[SECURITY] Fedora 16 Update: wireshark-1.6.5-1.fc16

Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package...

PHP Hashtables Denial of Service

Exploit for php platform in category dos / poc 0day.today 2018-02-06...

PHP 5.3.x Hashtables Proof Of Concept

...

FreeBSD -- pam_ssh() does not validate service names

Problem Description: Some third-party applications, including KDE's kcheckpass command, allow the user to specify the name of the policy on the command line. Since OpenPAM treats the policy name as a path relative to /etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run such an...

How to apply a SQL script to Veeam Backup & Replication/Veeam Backup Enterprise Manager Database

Purpose This article documents the procedure for applying a SQL script to a Microsoft SQL Server or PostgreSQL Database. Specifically, this article is targeted at the scenario where a support engineer has provided a .sql script to modify the Veeam Backup & Replication or Veeam Backup Enterprise...

[SECURITY] Fedora 16 Update: ykclient-2.6-1.fc16

commandline for yubikeys...

The Mole - Another Automatic SQL Injection exploitation tool

The Mole - Another Automatic SQL Injection exploitation tool The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based...

The Mole - Another Automatic SQL Injection exploitation tool

The Mole - Another Automatic SQL Injection exploitation tool The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based...

Low: Red Hat Security Advisory: virt-v2v security and bug fix update

An updated virt-v2v package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Apache mod_suexec Multiple Privilege Escalation Vulnerabilities

The remote host appears to be running Apache and is potentially affected by the following vulnerabilities: - Multiple race conditions exist in suexec between the validation and usage of directories and files. Under certain conditions local users are able to escalate privileges and execute arbitra...

Fedora Update for wireshark FEDORA-2011-15338

Check for the Version of wireshark OpenVAS Vulnerability Test Fedora Update for wireshark FEDORA-2011-15338 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Fedora Update for wireshark FEDORA-2011-15328

Check for the Version of wireshark OpenVAS Vulnerability Test Fedora Update for wireshark FEDORA-2011-15328 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

OpenOffice.org Xterm Spawn

Some friends asked me some tips for how to make a locked down machine that doesn't allow the user to execute anything from the GUI and doesn't have a terminal emulator installed into starting a terminal, using an allowed application, OpenOffice. The below is hardly a security vulnerability unless...

[SECURITY] Fedora 14 Update: wireshark-1.4.10-1.fc14

Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package...