S9Y Serendipity 0.7-beta1 - SQL Injection

S9Y Serendipity 0.7-beta1 - SQL Injection Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s...

FreeBSD : lha -- numerous vulnerabilities when extracting archives (91)

The following package needs to be updated: lha %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg273cc1a30d6b11d98a8a000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-2006...

@stake advisory: Lexar JumpDrive Secure Password Extraction

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Lexar JumpDrive Securetm Password Extraction Release Date: 09-13-2004 Application: JumpDrive Securetm Version 1.0 and Lexar Safe Guardtm software Platform: Windows and Mac Severity: An...

CVE-2002-1425

Directory traversal vulnerability in munpack in mpack 1.5 and earlier allows remote attackers to create new files in the parent directory via a ../ dot-dot sequence in the filename to be extracted...

CVE-2001-1267

The CVE-2001-1267 entry describes a directory traversal in GNU tar

NetBIOS Name Service Reply Information Disclosure

Binary data 1922.prm...

nucleusCMSSQL.txt

!/usr/bin/php ? // Nucleus CMS v3.01 addcoment/itemid SQL Injection Proof of Concept // By aCiDBiTS [email protected] 24-July-2004 // // Nucleus CMS http://nucleuscms.org is a weblog php+mysql application. // // This Proof of Concept dumps the username and MD5password of the admin user placed ...

Polar Helpdesk 3.0 - Cookie Based Authentication Bypass

source: https://www.securityfocus.com/bid/10775/info Polar Helpdesk is reported prone to a cookie based authentication system bypass vulnerability. It is reported that the authentication and privilege system for Polar Helpdesk is based entirely on the values read from a cookie that is saved on th...

RHEL 2.1 : unzip (RHSA-2002:138)

The unzip and tar utilities contain vulnerabilities which can allow arbitrary files to be overwritten during archive extraction. The unzip and tar utilities are used for dealing with archives, which are multiple files stored inside of a single file. A directory traversal vulnerability in unzip...

security flaw

Multiple stack-based buffer overflows in the getheader function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testi...

YabbSE (3 on 1)

Summary YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. This time we discovered three new holes. That ranges from extracting information to deleting information and files in the remote web server. Details Vulnerable Systems: YaBB SE versions 1.5.4, 1.5.5...

phpBB 2.0.6 search_id sql injection MD5 Hash Remote Exploit

Exploit for unknown platform in category web applications =========================================================== phpBB 2.0.6 searchid sql injection MD5 Hash Remote Exploit =========================================================== !/usr/bin/perl -w use IO::Socket; PROOF-OF-CONCEPT work only...

GameSpy Arcade Arbitrary File Writing Vulnerability

ThreeZee Technology, Inc. Security Advisory TZT002 Advisory: GameSpy Arcade Arbitrary File Writing Discovered: July 26, 2003 Released: July 31, 2003 Risk: Critical; Allows writing of a file to any location on the victim's system. Author: Mike Kristovich, Security Researcher ThreeZee Technology,...

Moderate: Red Hat Security Advisory: : : : Updated unzip and tar packages that fix vulnerabilities are now available

Updated unzip and tar packages are available for IBM iSeries and pSeries systems. These packages resolve vulnerabilities allowing arbitrary files to be overwritten during archive extraction. The unzip and tar utilities are used for manipulating archives, which are multiple files stored inside of ...

Moderate: Red Hat Security Advisory: : Updated unzip packages fix trojan vulnerability

Updated unzip packages resolving a vulnerability allowing arbitrary files to be overwritten are now available. Updated 15 August 2003 Ben Laurie found that the original patch to fix this issue missed a case where the path component included a quoted slash. These updated packages contain a new pat...

More and More SQL injection on PHP-Nuke 6.5.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 /----------------------------------------------------------------------------- | 7 A 6 9 - A d v C: 011 |-----------------------------------------------------------------------------| | | PHP-Nuke SQL injection |...

unzip directory traversal revisited

unzip directory traversal revisited problem: well I kinda stumbled over this when i was looking for something else A while back some fuss was made over the use of .. sequences in archives because it allows you to craft an archive which will trojan your system on extraction the creators of unzip...

InfoZip unzip directory traversal

Special characters in file name, skipped during extraction, allow to masquarade directory traversal...

Info-ZIP UnZip 5.50 - Encoded Character Hostile Destination Path

source: https://www.securityfocus.com/bid/7550/info Info-ZIP UnZip contains a vulnerability during the handling of pathnames for archived files. Specifically, when certain encoded characters are inserted into '../' directory traversal sequences, the creator of the archive can cause the file to be...

Multiple SQL injection on OpenBB forums

/----------------------------------------------------------------------------- | 7 A 6 9 - A d v C: 008 |-----------------------------------------------------------------------------| | | SQL injection on OpenBB forums | ----------------------------------------------------------------------------...