GDL 4.2 - Multiple Vulnerabilities

GDL version 4.2 suffers from cross site scripting, remote SQL injection, and directory traversal vulnerabilities. - Title : GDL 4.2 Multiple Vulnerabilities - Down. Script : http://kmrg.itb.ac.id/ - http://kmrg.itb.ac.id/gdl42.zip - Author : ByEge - Home : http://byege.blogspot.com.tr/ - Tested :...

BIWEB门户版Getwebshell漏洞

简要描述： 厂商来不来？ 详细说明： wap/detail.php（还有好几处，修复时请留意） if !empty$GET'mod' $strModuleID = strval$GET'mod'; //此处未过滤 includeonce'../'.$strModuleID.'/config/var.inc.php'; //包含需截断 $objWebInit-setDBG$arrGPdoDB; $objWebInit-db; $arrLink = 'mod=' . $strModuleID; else includeonce'include/title.php';...

DEBIAN-CVE-2014-0032

The getresource function in repos.c in the moddavsvn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via vectors related to the server root and request methods other than GET, as...

PT-2014-4171

Name of the Vulnerable Software and Affected Versions AuraCMS versions 2.3 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the search parameter to "mod/content/content.php" or through the CLIENT IP, X FORWARDED FOR, X...

CVE-2014-1401: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 search parameter to mod/content/content.php or 2 CLIENTIP, 3 XFORWARDEDFOR, 4 XFORWARDED, 5 FORWARDEDFOR, or 6 FORWARDED HTTP header to index.php...

[Suricata 1.4.7] Open Source Next Generation Intrusion Detection and Prevention Engine

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. OISF is part of and funded by the Department of...

MGASA-2013-0381 Updated apache-mod_nss package fixes CVE-2013-4566

Updated apache-modnss package fixes security vulnerability: A flaw was found in the way modnss handled the NSSVerifyClient setting for the per-directory context. When configured to not require a client certificate for the initial connection and only require it for a specific directory, modnss...

UBUNTU-CVE-2013-4566

modnss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions...

Fedora 18 : lynis-1.3.6-1.fc18 (2013-22758)

1.3.6 2013-12-03 New : - Support for the dntpd time daemon - New Apache test for modules HTTP-6632 - Apache test for modevasive HTTP-6640 - Apache test for modqos HTTP-6641 - Apache test for modspamhaus HTTP-6642 - Apache test for ModSecurity HTTP-6643 - Check for installed package audit tool...

DEBIAN-CVE-2013-4505

The isthislegal function in moddontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service resource consumption via a relative URL in a REPORT request...

DEBIAN-CVE-2013-4558

The getparentresource function in repos.c in moddavsvn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service assertion failure and Apache...

mod_nss: incorrect handling of NSSVerifyClient in directory context

modnss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions...

PT-2013-5077

Name of the Vulnerable Software and Affected Versions mod nss versions 1.0.8 and earlier Description The issue allows remote attackers to bypass intended access restrictions when NSSVerifyClient is set to none for the server/vhost context, and the setting is not enforced in the directory context...

PT-2013-5945

Name of the Vulnerable Software and Affected Versions Apache HTTP Server mod pagespeed module versions 0.x through 1.6.29.6 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions 0...

PT-2013-5739

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.2.22 Description The mod headers module in the Apache HTTP Server allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer...

PT-2013-4975

Name of the Vulnerable Software and Affected Versions mod fcgid module versions prior to 2.3.9 for the Apache HTTP Server Description A heap-based buffer overflow issue exists in the fcgid header bucket read function in fcgid bucket.c, allowing remote attackers to have an unspecified impact via...

Debian DSA-2778-1 : libapache2-mod-fcgid - heap-based buffer overflow

Robert Matthews discovered that the Apache FCGID module, a FastCGI implementation for Apache HTTP Server, fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially...

Debian Security Advisory DSA 2778-1 (libapache2-mod-fcgid - heap-based buffer overflow)

Robert Matthews discovered that the Apache FCGID module, a FastCGI implementation for Apache HTTP Server, fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially...

[SECURITY] [DSA 2778-1] libapache2-mod-fcgid security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2778-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 12, 2013 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-2778-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...