phpMyAdmin: Information disclosure

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser. Description Cezary Tomczak reported that an undefined UploadDir variable exposes an information disclosure vulnerability when running on shared hosts. Impact A remote attack...

Design/Logic Flaw

Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable...

CVE-2008-1924

Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable...

Integer overflow

Integer overflow in the wsgetpostvars function in Firefly Media Server formerly mt-daapd 0.2.4.1 0.9r1696-1.2 on Debian allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an HTTP POST request with a large Content-Length...

CVE-2008-1771

Integer overflow in the wsgetpostvars function in Firefly Media Server formerly mt-daapd 0.2.4.1 0.9r1696-1.2 on Debian allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an HTTP POST request with a large Content-Length...

CVE-2008-1771

Integer overflow in the wsgetpostvars function in Firefly Media Server formerly mt-daapd 0.2.4.1 0.9r1696-1.2 on Debian allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an HTTP POST request with a large Content-Length...

CVE-2008-1771

CVE-2008-1771 describes an integer overflow in ws_getpostvars in mt-daapd (Firefly Media Server) v0.2.4.1 and related builds, triggered by a large HTTP POST Content-Length. This can cause a heap buffer overflow with potential remote code execution, alongside denial of service. Connected advisorie...

CVE-2002-2400

Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long HTTP POST request...

CVE-2002-2400

CVE-2002-2400 describes a buffer overflow in LibHTTPD 1.2’s httpdProcessRequest function. An attacker can send a long HTTP POST request to trigger a crash and potentially execute arbitrary code, enabling remote compromise without authentication. The issue is documented with a high-severity impact...

CVE-2002-2258

Moby NetSuite allows remote attackers to cause a denial of service crash via an HTTP POST request with a 1 large integer or 2 non-numeric value in the Content-Length header, which causes an access violation after a failed atoi function call...

CVE-2002-2258

CVE-2002-2258 affects Moby NetSuite. A remote attacker can crash the service by sending an HTTP POST with a Content-Length header containing a large integer or non-numeric value, triggering an access violation after a failed atoi(). The documents do not provide any remediation, exploit details, o...

Cross site request forgery (csrf)

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2006-4511

Messenger Agents nmma.exe in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers to cause a denial of service crash via a crafted HTTP POST request to TCP port 8300 with a modified val parameter, which triggers a null dereference related to "zero-size strings in blowfish routines."...

CVE-2006-3819

Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST request containing a parameter name starting with "TYPEOF"...

CVE-2006-3546: Undefined Security Weakness

Patrice Freydiere ImgSvr aka ADA Image Server allows remote attackers to cause a denial of service daemon crash via a long HTTP POST request. NOTE: this might be the same issue as CVE-2004-2463...

imgsvrDoS.txt

I have provided the fillowing proof of concept.. Afected-softwear Credit's :n00b. http://freshmeat.net/projects/imgsvr/ Exploit, !/usr/bin/perl Proof of concept. Credit's:to n00b for finding this bug. Afected :ImgSvr.exe Download softwear: http://freshmeat.net/projects/imgsvr/ Crash the server wi...

ImgSvr 0.6.5 - POST Denial of Service

!/usr/bin/perl Proof of concept. Credit's:to n00b for finding this bug. Afected :ImgSvr.exe Download softwear: http://freshmeat.net/projects/imgsvr/ Crash the server with overly long http post request.. Main site of affected product. http://freshmeat.net/projects/imgsvr/ Sending an overly long po...

Cross site scripting

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...