2678 matches found
Recursive eval call causes confirm dialogs to evaluate to true — Mozilla
Security researcher Zach Hoffman reported that a recursive call to eval wrapped in a try/catch statement places the browser into a inconsistent state. Any dialog box opened in this state is displayed without text and with non-functioning buttons. Closing the window causes the dialog to evaluate t...
Symantec IM Manager IMAdminSchedTask.asp Eval Code Injection Remote Code Execution (SYM11-004)
The version of Symantec IM Manager installed on the remote Windows host is earlier than 8.4.17. The 'ScheduleTask' method exposed by the 'IMAdminSchedTask.asp' page fails to properly sanitize user input to a POST variable before using it in an 'eval' call. If a logged in console user can be trick...
XYCMS law firm built Station system V1. 0 multi-flaw-vulnerability warning-the black bar safety net
XYCMS law firm built Station system V1. 0 http://down.admin5.com/asp/71909.html B0mbErM@n ; 2011-2-18 eWebEditor http://127.0.0.1:99/system/xyeWebEditor/admin/login.asp User=XY2010 Pass=XY2010 XSS http://127.0.0.1:99/online.asp Qq:XSS Mail:XSS Photo:XSS Contents:XSS Eval...
ZDI-11-037: Symantec IM Manager Administrative Interface IMAdminSchedTask.asp Eval Code Injection Remote Code Execution Vulnerability
ZDI-11-037: Symantec IM Manager Administrative Interface IMAdminSchedTask.asp Eval Code Injection Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-037 January 31, 2011 -- CVE ID: CVE-2010-3719 -- CVSS: 8.5, AV:N/AC:M/Au:S/C:C/I:C/A:C -- Affected Vendors:...
CVE-2010-3719
Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method...
Sql injection
Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method...
CVE-2010-3719
Summary: CVE-2010-3719 affects Symantec IM Manager. The vulnerability resides in the admin interface’s ScheduleTask function (IMAdminSchedTask.asp) and involves improper sanitization of POST input passed to an eval() call. Affected product is Symantec IM Manager up to version 8.4.16; exploitation...
JavaScript eval() Usage on Web Server
Binary data 5723.prm...
MetInfo 3.0 PHP code injection vulnerability(getshell)-vulnerability warning-the black bar safety net
Official website: http://www.metinfo.cn/ Keyword:"Powered by MetInfo 3.0" Description: In the file/include/common. inc. php 6 line 7: evalbase64decode$allclass0; $allclass0 variable is not initialized, so we can control its value, the code injection use. POC: the...
MetInfo 3.0 PHP Code Injection Vulnerability
Exploit for php platform in category web applications ============================================ MetInfo 3.0 PHP Code Injection Vulnerability ============================================ Exploit Title£ºMetInfo 3.0 PHP Code Injection Vulnerability Date:2010-10-31 Author£ºlinux520.com...
Javascript eval Case Sensitivity Obfuscation
Although various security products provide coverage against many web vulnerabilities, such as ActiveX exploits, these known exploits could potentially bypass security products by using JavaScript obfuscation techniques.An example of such a technique is the JavaScript "eval" obfuscation, which is...
PHP code execution vulnerability summary-vulnerability warning-the black bar safety net
PHP security lovers of the feastthe Month of PHP Security it. Read php-security on many of the cattle below, to issue to the shared under a., are idols wow. A code to perform the function In PHP you can execute the Code of the function. Such as eval , assert , theand system and exec and shellexec...
cyask system background Getshell vulnerabilities-vulnerability warning-the black bar safety net
cyask will set the parameters to the write cache, the write cache when removed from the database unfiltered data directly to write the file, resulting in can get webshell Analysis: admin/settingmanage. php file: ? php adminfooter; exit; elseif$adminaction=='settingedit' ifisset$POST'editsubmit'...
PHP code execution vulnerability-summary-vulnerability warning-the black bar safety net
Reference from:http://php-security.org/2010/05/20/mops-submission-07-our-dynamic-php/index.html A code execution function In PHP you can execute the Code of the function. Such as eval , assert , theand system and exec and shellexec and passthru and escapeshellcmd and pcntlexec , etc. demo code 1....
Sql injection
Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...
CVE-2010-1546
Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...
CVE-2010-1546
CVE-2010-1546 affects Drupal's Chaos Tool Suite (CTools) module 6.x, prior to 6.x-1.4. An eval injection in the import functionality allows a remote authenticated user with "administer page manager" privileges to execute arbitrary PHP code via input to a text area, via the page_manager_page_impor...
Sql injection
Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via the anticode parameter...
CVE-2009-4836
The CVE-2009-4836 entry concerns Movie PHP Script 2.0. Affected component: system/services/init.php. Root cause: eval injection via the anticode parameter, enabling remote attackers to execute arbitrary PHP code. The vulnerability is described as a remote code execution risk with network access a...