bash terminal characters injection

It's possible to inject ESC-sequences into ls command output...

GNU Bash 4.0 - ls Control Character Command Injection

GNU Bash 4.0 - ls Control Character Command Injection source: https://www.securityfocus.com/bid/37776/info GNU Bash is prone to a command-injection vulnerability because it fails to adequately sanitize control characters in the 'ls' command. Attackers can exploit this issue to execute arbitrary...

CVE-2009-3542

Summary: CVE-2009-3542 affects LittleSite (LittleSite.php) 0.1 and is a Local File Inclusion (LFI) vulnerability in ls.php. An attacker can craft the file parameter in index.php to perform directory traversal using .. to include and execute arbitrary local files. In some environments, this may en...

Qualiteam X-Cart远程命令执行漏洞

BUGTRAQ: 9560 X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。 问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart 3.4.11 Qualiteam X-Cart 3.4.3 Qualiteam X-Cart 3.4 .0 Qualiteam X-Cart 3.3.2 Qualiteam X-Cart 3.3 .0 Qualiteam X-Cart 3.2.1 Qualite...

CVE-2009-2521: Uncontrolled Resource Consumption

Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services IIS 5.0 through 7.0 allows remote authenticated users to cause a denial of service daemon crash via a list ls -R command containing a wildcard that references a subdirectory, followed by a .. dot dot, ak...

RedHat Update for vsftpd RHSA-2008:0295-01

Check for the Version of vsftpd OpenVAS Vulnerability Test RedHat Update for vsftpd RHSA-2008:0295-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Sepal SPBOARD 4.5 (board.cgi) Remote Command Exec Vulnerability

No description provided by source. | | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | Sepal's SPBOARD v4.5 board.cgi Remote Command Execution Vulnerability Script : : POC : |---...

RHEL 5 : vsftpd (RHSA-2008:0295)

An updated vsftpd package that fixes a security issue and several bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The vsftpd package includes a Very Secure File Transfer Protocol FTP daemon. A...

Unfixed XSS vulnerability at www.ls-takano.com

Security researcher iNs uNkn0wn.eu CreW, has submitted on 12/10/2007 a cross-site-scripting XSS vulnerability affecting www.ls-takano.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/10/2007. It i...

CVE-2002-2387

Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. dot dot in the LS command...

CVE-2002-2387

Hyperion FTP server 2.8.1 is affected by a directory traversal vulnerability that allows remote attackers to read arbitrary files via a .. (dot dot) in the LS command. The issue is documented across multiple sources (NVD entry, Red Hat CVE page, CVE listing). The connected documents do not provid...

CVE-2002-2387: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Hyperion FTP server 2.8.1 allows remote attackers to read arbitrary files via a .. dot dot in the LS command...

CVE-2003-1416: Improper Input Validation

BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service CPU consumption via a long 1 ls or 2 cwd command...

CVE-2003-1380: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to 1 list directories above the root via an 'ls @../' command, or 2 list files above the root via a "mget @../FILE" command...

LS simple guestbook (v1) Remote Code Execution Vulnerability

Special Greetings To - Timq,Warpboy,The-Maggot File: index.php Affects: LS simple guestbook v1 Date: 15th April 2007 Issue Description: =========================================================================== LS simple guestbook fails to sanitize user input that it writes to the posts.txt file...

CVE-2007-2092

Vulnerability summary (CVE-2007-2092): Direct static code injection in the PHP file index.php of Limesoft Guestbook (LS Simple Guestbook). An attacker can inject arbitrary PHP code into posts.txt via the name parameter, enabling code execution on the server. The issue is tied to feeding unsanitiz...

CVE-2007-2093

The vulnerability CVE-2007-2093 affects Limesoft Guestbook (LS Simple Guestbook) 1.0. Affected component: index.php handling the message parameter, allowing direct static code injection into posts.txt. Root cause: improper handling of user input in the guestbook script enables arbitrary PHP code ...

CVE-2007-2093: Undefined Security Weakness

Direct static code injection vulnerability in index.php in Limesoft Guestbook LS Simple Guestbook 1.0 allows remote attackers to inject arbitrary PHP code into posts.txt via the message parameter...

LS simple guestbook - arbitrary code execution

Special Greetings To - Timq,Warpboy,The-Maggot File: index.php Affects: LS simple guestbook v1 Date: 15th April 2007 Issue Description: =========================================================================== LS simple guestbook fails to sanitize user input that it writes to the posts.txt file...

ls-exec.txt

Special Greetings To - Timq,Warpboy,The-Maggot File: index.php Affects: LS simple guestbook v1 Date: 15th April 2007 Issue Description: =========================================================================== LS simple guestbook fails to sanitize user input that it writes to the posts.txt file...