ZABBIX<= 1.8.1 DBcondition函数SQL注入漏洞

BUGTRAQ ID: 39148 CVE ID: CVE-2010-0686 zabbix是一个CS结构的分布式网络监控系统。 Zabbix API使用了include/db.inc.php中定义的DBcondition函数来执行SQL查询中WHERE子句的条件。该函数没有对用户提供数据提供额外的检查： function DBcondition$fieldname, &$array, $notin=false, $string=false global $DB; $condition = ''; ---cut--- $in = $notin?' NOT IN ':' IN ';...

VMware WebAccess URL转发安全漏洞

BUGTRAQ ID: 39103 CVE ID: CVE-2010-0686 VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。 VMWare的WebAccess组件没有充分地验证用户所提供的输入，允许将入站请求转发到其他目的地。所转发的目标无法看到请求URL的真实来源，只能看到运行WebAccess的机器地址。攻击者可以利用这个转发漏洞伪造源址定向服务器上通讯。 VMWare Server 2.0 VMWare VirtualCenter 2.5 VMWare VirtualCenter 2.0.2 VMWare ESX 3.5...

CVE-2010-0686

WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability."...

CVE-2010-0686

Summary: CVE-2010-0686 concerns VMware WebAccess in VMware VirtualCenter (2.0.2/2.5), VMware Server 2.0, and VMware ESX (3.0.3/3.5). The issue is a URL forwarding vulnerability where the WebAccess proxy functionality does not properly validate/limit inbound requests, allowing an attacker to spoof...

VMSA-2010-0005 VMware products address vulnerabilities in WebAccess

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2010-0005 Synopsis: VMware products address vulnerabilities in WebAccess Issue date: 2010-03-29 Updated on: 2010-03-29 initial releas...