CVE-2012-3280

Technical details (affected products/versions, root cause, fix) are not provided in the initial or connected documents. No concrete technical information is available here; monitor for updates and future disclosures.

CVE-2012-3280: Undefined Security Weakness

Multiple unspecified vulnerabilities on HP NonStop Servers H06.x and J06.x allow remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via an OSS Remote Operation over an Expand connection...

DEBIAN-CVE-2012-6090

Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted filename...

UBUNTU-CVE-2012-6090

Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted filename...

CVE-2012-6090: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted filename...

libpng: buffer overwrite in png_rgb_to_gray

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the pngrgbtogray function but not the pngsetexpand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and...

CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

CVE-2011-2179: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

UBUNTU-CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

DEBIAN-CVE-2010-1132

The mlfienvrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message...

vim: heap buffer overflow in mch_expand_wildcards()

Heap-based buffer overflow in the mchexpandwildcards function in osunix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case...

PT-2008-4835 · Vim +1 · Vim +1

Name of the Vulnerable Software and Affected Versions: Vim versions 6.2 through 6.3 Description: The issue is related to a heap-based buffer overflow in the mch expand wildcards function, which can be exploited by user-assisted attackers to execute arbitrary code via shell metacharacters in...

CVE-2007-6394

SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter in an expand action...

CVE-2007-6394: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter in an expand action...

PT-2007-5244 · Microsoft +1 · Ntfs +2

Name of the Vulnerable Software and Affected Versions: Guidance Software EnCase affected versions not specified Description: The issue allows user-assisted remote attackers to cause a denial of service via three main vectors: 1 a corrupted Microsoft Exchange database, which triggers an applicatio...

PT-2007-1729 · Grsecurity · Grsecurity Pax

Name of the Vulnerable Software and Affected Versions: grsecurity PaX affected versions not specified Description: The issue concerns an unspecified vulnerability in the expand stack function, potentially allowing local users to gain privileges through unspecified vectors. However, the grsecurity...

FreeBSD : vim -- vulnerabilities in modeline handling: glob, expand (81f127a8-0038-11da-86bc-000e0c2e438a)

Georgi Guninski discovered a way to construct Vim modelines that execute arbitrary shell commands. The vulnerability can be exploited by including shell commands in modelines that call the glob or expand functions. An attacker could trick an user to read or edit a trojaned file with modelines...

USN-154-1: vim vulnerability

Georgi Guninski discovered that it was possible to construct Vim modelines that execute arbitrary shell commands by wrapping them in glob or expand function calls. If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands...

FreeBSD : clamav -- MS-Expand file handling DoS vulnerability (6d18fe19-ee67-11d9-8310-0001020eed82)

An iDEFENSE Security Advisory reports : Remote exploitation of an input validation error in Clam AntiVirus ClamAV allows attackers to cause a denial of service condition. The vulnerability specifically exists due to improper behavior during exceptional conditions. Successful exploitation allows...