event Calendar - Multiple Vulnerabilities

event Calendar - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/11693/info Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported: A cross-site...

vBulletin - 'LAST.php' SQL Injection

Example: http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201 milw0rm.com 2004-11-15...

Coppermine Photo Gallery Detection

This plugin determines if Coppermine Photo Gallery is installed on the remote web server and extracts version numbers and locations of any instances found. Coppermine is an open source, web-based picture gallery application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if...

unzoo -- Directory Traversal Vulnerability

Secunia reports: Doubles has discovered a vulnerability in Unzoo, which potentially can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an input validation error when unpacking archives. This can be exploited via a directory traversal attack to...

cabextract -- insecure directory handling

cabextract has insufficient checks for file names that contain ../. This can cause files to be extracted to the parent directory...

S9Y Serendipity 0.7-beta1 - SQL Injection

S9Y Serendipity 0.7-beta1 - SQL Injection Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s...

S9Y Serendipity 0.7-beta1 - SQL Injection

Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s "$1/exit.php?urlid=1&entryid=1%20and%200%20union%20select%20username%20from%20serendipityauthors%20where%20authorid%3D1" |...

FreeBSD : lha -- numerous vulnerabilities when extracting archives (91)

The following package needs to be updated: lha %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg273cc1a30d6b11d98a8a000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-2006...

@stake advisory: Lexar JumpDrive Secure Password Extraction

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Lexar JumpDrive Securetm Password Extraction Release Date: 09-13-2004 Application: JumpDrive Securetm Version 1.0 and Lexar Safe Guardtm software Platform: Windows and Mac Severity: An...

CVE-2001-1267

The CVE-2001-1267 entry describes a directory traversal in GNU tar

CVE-2002-1425

Directory traversal vulnerability in munpack in mpack 1.5 and earlier allows remote attackers to create new files in the parent directory via a ../ dot-dot sequence in the filename to be extracted...

NetBIOS Name Service Reply Information Disclosure

Binary data 1922.prm...

nucleusCMSSQL.txt

!/usr/bin/php ? // Nucleus CMS v3.01 addcoment/itemid SQL Injection Proof of Concept // By aCiDBiTS [email protected] 24-July-2004 // // Nucleus CMS http://nucleuscms.org is a weblog php+mysql application. // // This Proof of Concept dumps the username and MD5password of the admin user placed ...

Polar Helpdesk 3.0 - Cookie Based Authentication Bypass

source: https://www.securityfocus.com/bid/10775/info Polar Helpdesk is reported prone to a cookie based authentication system bypass vulnerability. It is reported that the authentication and privilege system for Polar Helpdesk is based entirely on the values read from a cookie that is saved on th...

RHEL 2.1 : unzip (RHSA-2002:138)

The unzip and tar utilities contain vulnerabilities which can allow arbitrary files to be overwritten during archive extraction. The unzip and tar utilities are used for dealing with archives, which are multiple files stored inside of a single file. A directory traversal vulnerability in unzip...

security flaw

Multiple stack-based buffer overflows in the getheader function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testi...

YabbSE (3 on 1)

Summary YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. This time we discovered three new holes. That ranges from extracting information to deleting information and files in the remote web server. Details Vulnerable Systems: YaBB SE versions 1.5.4, 1.5.5...

phpBB 2.0.6 search_id sql injection MD5 Hash Remote Exploit

Exploit for unknown platform in category web applications =========================================================== phpBB 2.0.6 searchid sql injection MD5 Hash Remote Exploit =========================================================== !/usr/bin/perl -w use IO::Socket; PROOF-OF-CONCEPT work only...

GameSpy Arcade Arbitrary File Writing Vulnerability

ThreeZee Technology, Inc. Security Advisory TZT002 Advisory: GameSpy Arcade Arbitrary File Writing Discovered: July 26, 2003 Released: July 31, 2003 Risk: Critical; Allows writing of a file to any location on the victim's system. Author: Mike Kristovich, Security Researcher ThreeZee Technology,...

Moderate: Red Hat Security Advisory: : : : Updated unzip and tar packages that fix vulnerabilities are now available

Updated unzip and tar packages are available for IBM iSeries and pSeries systems. These packages resolve vulnerabilities allowing arbitrary files to be overwritten during archive extraction. The unzip and tar utilities are used for manipulating archives, which are multiple files stored inside of ...