216 matches found
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that 1 modify a .htaccess file via an unspecified request to protected/manager.cgi or 2 change th...
CVE-2009-4555
Multiple cross-site request forgery CSRF vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that 1 modify a .htaccess file via an unspecified request to protected/manager.cgi or 2 change th...
CVE-2009-3558
The posixmkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass openbasedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file...
CVE-2009-3558
The posixmkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass openbasedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file...
FreeBSD Ports: apache
The remote host is missing an update to the system as announced in the referenced advisory. VID e15f2356-9139-11de-8f42-001aa0166822 OpenVAS Vulnerability Test $ Description: Auto generated from VID e15f2356-9139-11de-8f42-001aa0166822 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...
httpd: AllowOverride Options=IncludesNoExec allows Options Includes
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...
apr-util heap buffer underwrite
The aprstrmatchprecompile function in strmatch/aprstrmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service daemon crash via crafted input involving 1 a .htaccess file used with the Apache HTTP Server, 2 the SVNMasterURI directive in the moddavsvn module in t...
apr-util heap buffer underwrite
The aprstrmatchprecompile function in strmatch/aprstrmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service daemon crash via crafted input involving 1 a .htaccess file used with the Apache HTTP Server, 2 the SVNMasterURI directive in the moddavsvn module in t...
Debian: Security Advisory (DSA-1812-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Heap overflow
The aprstrmatchprecompile function in strmatch/aprstrmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service daemon crash via crafted input involving 1 a .htaccess file used with the Apache HTTP Server, 2 the SVNMasterURI directive in the moddavsvn module in t...
Mandriva Linux Security Advisory : apache (MDVSA-2009:124-1)
Multiple vulnerabilities has been found and corrected in apache : Memory leak in the zlibstatefulinit function in crypto/comp/czlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service memory consumption via multiple calls, as demonstrated by initial S...
Design/Logic Flaw
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...
httpd: AllowOverride Options=IncludesNoExec allows Options Includes
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...
Claroline 1.8.11 Cross Site Scripting
Author: Gerendi Sandor Attila Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html Date: May 05, 2009 Package: Claroline 1.8.11 Product Homepage: http://www.claroline.net/ Versions Affected: v.1.8.11 Other versions may also be affected Severity: Medium...
comdev-sql.txt
--==+================================================================================+==-- --==+ Comdev News Publisher SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- Discovered By: t0pP8uZz & xprog Discovered On: 4 Apri...
CVE-2007-6650
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file...
CVE-2007-6650
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file...
SimplePHPBlog Hacking
How to hack a server with Simple PHP Blog uploading an htacess file from imguploadcgi.php page. Tested on v0.4.9 by Demential http://www.hackish.eu mailto: [email protected] video here: http://hackish.eu/video/phpblog.avi vlc download: http://www.videolan.org/vlc/...
Cahier de texte 2.0 (Database Backup/Source Disclosure) Remote Exploit
Exploit for unknown platform in category web applications ====================================================================== Cahier de texte 2.0 Database Backup/Source Disclosure Remote Exploit ====================================================================== !/usr/bin/perl INFORMATIONS...
forumv04c.txt
!/usr/bin/perl Affected.scr..: µforum v0.4c Poc.ID........: 08060901 Type..........: Member's passwords are stored in .dat file no protected by a .htaccess file Risk.level....: Medium Vendor.Status.: Unpatched Src.download..: comscripts.com/scripts/php.forum.1568.html Poc.link......:...