PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

Impact Due to lack of limits by default in the explode function, malicious clients were able to abuse some packets to waste server CPU and memory. This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a...

PT-2025-10711

Impact Due to lack of limits by default in the explode function, malicious clients were able to abuse some packets to waste server CPU and memory. This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a...

SUSE CVE-2008-3659

Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since...

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution...

Friday Squid Blogging: Squid-Like Underwater Drone

The Sea Hunting Autonomous Reconnaissance Drone SHARD swims like a squid and can explode on command. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Directory traversal

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive...

Liar, liar, pants on fire! Barclays phish claims cards explode

We feel compelled to relay the dire warning from this Barclays snail-mail letter, which we acquired through social media, therefore it must be true. Warning: Barclays debit cards may catch fire! The letter reads as follows: Dear costumer, Many of our bank costumers have reported that their debit...

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution...

This 'Killer USB' can make your Computer explode

Can Hackers turn a remote computer into a bomb and explode it to kill someone, just like they do in hacker movies? Wait, wait! Before answering that, Let me tell you an interesting story about Killer USB drive: A man walking in the subway stole a USB flash drive from the outer pocket of someone...

WordPress AdRotate plugin <= 3.6.6 - SQL Injection

No description provided by source. Exploit Title: WordPress AdRotate plugin = 3.6.6 SQL Injection Vulnerability Date: 2011-11-8 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.6.zip Version: 3.6.6 tested Note:...

WordPress AdRotate plugin <= 3.6.6 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress AdRotate plugin = 3.6.6 SQL Injection Vulnerability Date: 2011-11-8 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.6.zip Version: 3.6.6 tested Note:...

Memory corruption

Memory leak in the ldapexploderdn API function in IBM Tivoli Directory Server TDS 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allows remote authenticated users to cause a denial of service memory consumption by making many function calls...

CVE-2009-5072

Memory leak in the ldapexplodedn function in IBM Tivoli Directory Server TDS 6.0 before 6.0.0.61 aka 6.0.0.8-TIV-ITDS-IF0003 allows remote authenticated users to cause a denial of service memory consumption via an empty string argument...

PT-2011-1283

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions prior to 5.2.0.5-TIV-ITDS-LA0007 Description The issue is related to a memory leak in the ldap explode rdn API function. This allows remote authenticated users to cause a denial of service by consuming memo...

PT-2011-1326

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions prior to 6.0.0.61 Description A memory leak issue exists in the ldap explode dn function, allowing remote authenticated users to cause a denial of service by consuming memory via an empty string argument...

PHP < 5.2.9 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.9. Such versions may be affected by several security issues : - Background color is not correctly validated with a non true color image in function 'imagerotate'. CVE-2008-5498 - A denial of service conditi...

phpAbook 0.8.8b - cookie Local File Inclusion

phpAbook 0.8.8b - cookie Local File Inclusion phpAbook ... 61: if isset$HTTPCOOKIEVARS"userInfo" && $HTTPCOOKIEVARS"userInfo" != "" $userArray = explode" ", $HTTPCOOKIEVARS"userInfo"; $userName = $userArray0; $userID = $userArray1; $userLang = $userArray2;...

phpAbook 0.8.8b - 'cookie' Local File Inclusion

phpAbook ... 61: if isset$HTTPCOOKIEVARS"userInfo" && $HTTPCOOKIEVARS"userInfo" != "" $userArray = explode" ", $HTTPCOOKIEVARS"userInfo"; $userName = $userArray0; $userID = $userArray1; $userLang = $userArray2; include"include/lang/$userLang/inc.messages.php"; 67: x: INCLUDE exploit:...

Buffer overflow

Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since...

CVE-2008-3659: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since...