XBMC Web Server Directory Traversal

This module exploits a directory traversal bug in XBMC 11, up until the 2012-11-04 nightly build. The module can only be used to retrieve files. Module Options msf use auxiliary/gather/xbmc/traversal msf undefinedtraversal show actions ...actions... msf undefinedtraversal set ACTION msf...

Apache HTTP Server 'LD_LIBRARY_PATH'不安全库加载任意代码执行漏洞

BUGTRAQ ID: 53046 CVECAN ID: CVE-2012-0883 Apache HTTP Server是Apache软件基金会的一个开放源码的网页服务器，可以在大多数计算机操作系统中运行，由于其多平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server 2.4.2之前版本内的envvars 即envvars-std在LDLIBRARYPATH内放置了零长度的目录名称，通过在执行apachectl时在前工作目录内木马DSO，可允许本地用户获取权限。 0 Apache 2.2.x 厂商补丁： Apache Group...

libproxy -- stack-based buffer overflow

Tomas Hoger reports: A buffer overflow flaw was discovered in the libproxy's url::getpac used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application...

apache22 -- several vulnerabilities

Apache HTTP SERVER PROJECT reports: low: XSS due to unescaped hostnames CVE-2012-3499 Various XSS flaws due to unescaped hostnames and URIs HTML output in modinfo, modstatus, modimagemap, modldap, and modproxyftp. moderate: XSS in modproxybalancer CVE-2012-4558 A XSS flaw affected the...

CVE-2012-3819: Stack Overflow in DartWebserver.dll <= 1.9

Overview =============== DartWebserver.Dll is an HTTP server provided by Dart Comunications dart.com. It is distributed intheir PowerTCP/Webserver For ActiveX product and likely other similar products. "Build web applications in any familiar software development environment. Use WebServer for...

Dart Communications Stack Overflow Vulnerability

Exploit for windows platform in category dos / poc Overview =============== DartWebserver.Dll is an HTTP server provided by Dart Comunications dart.com. It is distributed intheir PowerTCP/Webserver For ActiveX product and likely other similar products. "Build web applications in any familiar...

Apple iOS MobileSafari LibTIFF Buffer Overflow

Exploit for hardware platform in category remote exploits $Id: safarilibtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing...

Dart Communications Stack Overflow

Overview =============== DartWebserver.Dll is an HTTP server provided by Dart Comunications dart.com. It is distributed intheir PowerTCP/Webserver For ActiveX product and likely other similar products. "Build web applications in any familiar software development environment. Use WebServer for...

Important: Red Hat Security Advisory: openssl security update

An update for the OpenSSL component for JBoss Enterprise Application Platform 6.0.0 for Solaris and Microsoft Windows that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact...

Apache HTTP Server envvars本地权限提升漏洞

CVE ID: CVE-2012-0883 Apache HTTP Server是Apache软件基金会的一个开放源码的网页服务器，可以在大多数计算机操作系统中运行，由于其多平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server 2.4.2之前版本的envvars 即envvars-std在LDLIBRARYPATH中放置了零长度的目录名称，可允许本地用户在执行apachectl过程中通过当前工作目录中的木马DSO获取权限。 0 Apache Group HTTP Server 2.4.2 厂商补丁： Apache Group...

CVE-2012-4360

Cross-site scripting XSS vulnerability in the modpagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4001

The modpagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers...

Cross site scripting

Cross-site scripting XSS vulnerability in the modpagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

The modpagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers...

CVE-2012-4360

CVE-2012-4360 is a cross-site scripting flaw in the mod_pagespeed Apache module (versions 0.10.19.1–0.10.22.4) that allowed remote attackers to inject arbitrary script via unspecified vectors. The issue affects Apache HTTP Server deployments using mod_pagespeed and could enable execution of JavaS...

CVE-2012-4001

CVE-2012-4001 affects the mod_pagespeed module for the Apache HTTP Server (versions before 0.10.22.6). The vulnerability arises from improper verification of the module’s host name, allowing remote attackers to trigger HTTP requests to arbitrary hosts (demonstrated via intranet targets) due to an...

CVE-2012-4001

The modpagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers...

CVE-2012-4360

Cross-site scripting XSS vulnerability in the modpagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

FreeBSD : mod_pagespeed -- multiple vulnerabilities (178ba4ea-fd40-11e1-b2ae-001fd0af1a4c)

Google Reports : modpagespeed 0.10.22.6 is a security update that fixes two critical issues that affect earlier versions : - CVE-2012-4001, a problem with validation of own host name. - CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1. The effect of the...

apache22 -- several vulnerabilities

Apache HTTP SERVER PROJECT reports: low: XSS in modnegotiation when untrusted uploads are supported CVE-2012-2687 Possible XSS for sites which use modnegotiation and allow untrusted uploads to locations which have MultiViews enabled. low: insecure LDLIBRARYPATH handling CVE-2012-0883 This issue w...