CVE-2011-5295

Affected product: Gogago YouTube Video Converter, version 1.1.6. The issue is a buffer overflow in the MDIEEx.dll ActiveX control’s Download method, allowing remote code execution via a long argument. This vulnerability is reported consistently across multiple sources (NVD, Red Hat, CNVD, CVE lis...

CVE-2011-5293

The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument...

Design/Logic Flaw

The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument...

CVE-2011-5291

The CVE-2011-5291 entry concerns Ashampoo 3D CAD Professional (3.x) before 3.0.2, where the SaveData method of the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx allows a remote attacker to write arbitrary files by supplying a pathname as the first argument. The vulnerability is rooted in...

CVE-2011-5291

The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument...

CVE-2011-5290

Technical summary (CVE-2011-5290): The vulnerability affects IDrive Online Backup 3.4.0, specifically the UniBasic100_EDA1811C.ocx’s UniBasicPack.UniTextBox ActiveX control. The SaveToFile method can be abused to write to arbitrary files by supplying a pathname as the first argument. This is a re...

CVE-2011-5289

The CVE-2011-5289 entry concerns the SaveDecrypted method of the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2.dll used by aTube Catcher 2.3.570. The vulnerability allows remote attackers to write to arbitrary files by supplying a pathname in the argument to SaveDecrypted. Docume...

CVE-2014-9636

unzip 6.0 allows remote attackers to cause a denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression...

PHPok v4.1 /framework/www/project/control.php SQL注入漏洞

/framework/www/projectcontrol.php $ext = $this-get"ext"; if$ext && isarray$ext $c = ''; foreach$ext AS $key=$value if$key && $value $c = "ext.".$key." LIKE '%".$value."%'"; $pageurl .= "ext".$key."=".rawurlencode$value."&"; if$c $dt'sqlext' = implode" AND ",$c; $this-assign'ext',$ext;...

ActiveBar ActiveX Method Arbitrary File Write - Ver2 (CVE-2007-3883)

An Overwrite Files vulnerability has been reported in The Data Dynamics ActiveBar ActiveX control. Successful exploitation of this vulnerability could allow a remote attacker to create or overwrite files via a full pathname in the second argument to the Save method, or the first argument to the...

Windows Meterpreter (skape/jt Injection), Hidden Bind Ipknock TCP Stager

Inject the meterpreter server DLL staged. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket will appea...

CVE-2011-1796

CVE-2011-1796 is a use-after-free in WebKit’s FrameView.cpp (WebCore) affecting Google Chrome up to version 11.0.696.65. The flaw allows a remote attacker to crash the browser (DoS) or potentially cause other impact via crafted JavaScript that calls removeChild while interacting with a FRAME elem...

hdwiki 一处sql注入

简要描述： 费了些力气，不过还是不错的。 注入，不过不是get方式，规则绕不过去，求大牛们秒了它，post方式注入，不过这个漏洞感觉很有意思。 最后再说，别不给确认，不给rank 详细说明： 先来看看Hdwiki处理提交数据的方式，get就算了，各种绕不过。 在/hdwiki/model/hdwiki.class.php中 大约 52行 $this-post = string::haddslashes$POST; //跟入 haddslashes函数如下,可以看到POST过来的数据处理addslashes单引号，双引号,反斜杠，NULL下 function...

从ThinkPHP谈基于框架开发程序的安全性（从SQL注入到代码执行）

简要描述： 从ThinkPHP谈基于框架开发程序的安全性，以ThinkPHP，ThinkSNS，大米CMS等最新版漏洞证明为例 详细说明： 从ThinkPHP谈基于框架开发程序的安全性，以ThinkPHP，ThinkSNS，大米CMS等为例 之前在看ThinkPHP开发手册的时候看到这个： 字符串方式 字符串方式条件即以字符串的方式将条件作为 where 方法的参数，例子： $Dao = M"User"; $List = $Dao-where'uidfind; 实际执行的 SQL 为： SELECT FROM user WHERE uidwhere'role='.$role-find;...

Konakart v7.3.0.1 CMS - CS Cross Site Web Vulnerability

Document Title: =============== Konakart v7.3.0.1 CMS - CS Cross Site Web Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=1362 Release Date: ============= 2014-12-04 Vulnerability Laboratory ID VL-ID: ==================================== 1362...

Design/Logic Flaw

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

TSUTAYA App for Android vulnerable to arbitrary Java method execution

Overview TSUTAYA App for Android contains a vulnerability where an arbitrary Java method may be executed. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

JVN#97384696: TSUTAYA App for Android vulnerable to arbitrary Java method execution

TSUTAYA App for Android contains a vulnerability where an arbitrary Java method may be executed. Impact When viewing a specially crafted web page, an arbitrary Java method may be executed. Solution Update the software Update to the latest version according to the information provided by the...