CVE-2009-5090

SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter and possibly other unspecified vectors...

[Заметка] SSI Web shell

1. Введение В данной заметке я рассмотрю примеры использования SSI, для обхода ограничений php в частности. 2. Теория SSI Server Side Includes — включения на стороне сервера — несложный язык для динамической «сборки» веб-страниц на сервере из отдельных составных частей и выдачи клиенту...

CVE-2011-2373

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document...

Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document...

Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document...

Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document...

(mod_dav_svn): File contents disclosure of files configured to be unreadable by those users

The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz shortcircuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to...

Fedora 15 : pure-ftpd-1.0.32-1.fc15 (2011-7434)

Updating to current 1.0.32 version. - added support SHA1 password hashing in MySQL and PostgreSQL backends - removed support for braces expansion in directory listings has been disabled CVE-2011-0418 - list of allowed ciphers for SSL/TLS connections can be specified Note that Tenable Network...

Sql injection

Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to authenticate.php and the 3 ID parameter to pwn.php. NOTE: some of these details are obtained fr...

BlackBerry WebKit Browser Engine Vulnerability

Research In Motion has released a security notice to alert users of a vulnerability affecting the WebKit browser engine provided in BlackBerry Device Software versions 6.0 and later. By convincing a user to browse to specially crafted website, a remote attacker may be able to execute arbitrary...

Web Site Links to Malicious Content (disabled)

This plugin has been temporarily disabled. The web site contains links that are listed as being malicious in public malware databases. Either users of the web site created the links e.g. comments added to a blog post, or the site has been compromised. Binary data urlthreatlookup.nbin...

OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Ciphersuite Disabled Cipher Issue

The version of OpenSSL on the remote host has been shown to allow the use of disabled ciphers when resuming a session. This means that an attacker that sees e.g. by sniffing the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent resumptions of that session to...

Sql injection

SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are obtained from third party information...

PT-2011-2346 · Tinybb · Tinybb

Name of the Vulnerable Software and Affected Versions: tinyBB version 1.2 Description: The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This can be achieved via the id parameter in a profile action to "index.php". Recommendations: For tinyBB...

CVE-2010-4680

The WebVPN implementation on Cisco Adaptive Security Appliances ASA 5500 series devices with software before 8.23 permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended access restrictions via CIFS requests, ak...

Apple Mac OS X WiFi DoS

System kernel panicin network with disabled mcs...

openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG downgrade-to-disabled ciphersuite attack

OpenSSL before 0.9.8j, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a...

RHEL 4 / 5 : thunderbird (RHSA-2010:0968)

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CVE-2010-4517

SQL injection vulnerability in the JExtensions JE Auto comjeauto component 1.0 for Joomla!, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the char parameter in an item action to index.php...

CVE-2010-4505

Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 un and 2 pw parameters...