phpMyAdmin执行任意命令漏洞

BugCVE: CAN-2001-1060 BUGTRAQ: 3121 phpMyAdmin中存在一个输入验证错误，允许远程攻击者执行任意命令。攻击者可能获取 敏感信息或者以httpd运行身份执行任意命令。 问题处在'tblcopy.php' 和 'tblrename.php'中的下列代码中: tblcopy.php: eval $message = \ $strCopyTableOK\ ; ; tblrename.php: eval $message = \ $strRenameTableOK\ ; ; 如果用户可以控制$strCopyTableOK 或...

Sql injection

Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary PHP code via the test parameter, and probably arbitrary parameters, to chat.php...

CVE-2008-3764

Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary PHP code via the test parameter, and probably arbitrary parameters, to chat.php...

CVE-2008-3764

CVE-2008-3764 describes an eval injection in Turnkey PHP Live Helper (PHP Live Helper) 2.0.1 and earlier. The vulnerability resides in globalsoff.php and allows remote attackers to execute arbitrary PHP code via the test parameter (and likely other parameters) passed to chat.php. This is a remote...

CVE-2008-3764: Improper Control of Generation of Code

Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary PHP code via the test parameter, and probably arbitrary parameters, to chat.php...

Sql injection

Eval injection vulnerability in admconfigset.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter...

CVE-2008-3332

CVE-2008-3332 is an eval() injection in adm_config_set.php in MantisBT prior to 1.1.2. Remote authenticated administrators can execute arbitrary PHP commands via the value parameter. Evidence from Gentoo GLSA 200809-10 and related advisories indicates upgrade to the latest MantisBT (>=1.1.2) a...

CVE-2008-3332: Improper Control of Generation of Code

Eval injection vulnerability in admconfigset.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter...

Sql injection

Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter...

CVE-2008-1060

The CVE affects the Sniplets WordPress plugin, specifically versions 1.1.2 and 1.2.2, where an eval injection in modules/execute.php allows remote attackers to execute arbitrary PHP code via the text parameter. This results in remote code execution with the webserver user’s privileges, aligning w...

CVE-2008-1060: Improper Control of Generation of Code

Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter...

WordPress Sniplets Plugin <= 1.2.2 - Eval Injection

Because of this vulnerability in modules/execute.php, the attackers can execute arbitrary PHP code via the "text" parameter. Solution Update the plugin...

Memory corruption

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service crash and possibly trigger memory corruption via 1 a large switch statement, 2 certain uses of watch and eval, 3 certain uses of t...

CVE-2008-0413

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service crash and possibly trigger memory corruption via 1 a large switch statement, 2 certain uses of watch and eval, 3 certain uses of t...

Mozilla javascript engine crashes

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service crash and possibly trigger memory corruption via 1 a large switch statement, 2 certain uses of watch and eval, 3 certain uses of t...

Design/Logic Flaw

Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via the filedata parameter...

CVE-2008-0503

CVE-2008-0503 affects Netwerk Smart Publisher 1.0.1. An eval() failure in admin/op/disp.php allows remote attackers to execute arbitrary PHP code via the filedata parameter, enabling unauthenticated, network-vector exploitation. CVSS 2.0 base score 6.8 ("NETWORK" attack vector, "MEDIUM" complexit...

CVE-2008-0503: Improper Control of Generation of Code

Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via the filedata parameter...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...