CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

DEBIAN-CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

ProFTPD AUTH多个验证模块安全绕过漏洞

proftpd是一款流行的开放源代码的FTP服务程序。 proftpd在AUTH API上存在一个错误，远程攻击者可以利用漏洞可以绕过安全限制，未授权访问。 由于FTP协议需要分开USER和PASS命令，ProFTPD独立的通过USER对用户数据进行检查，而当PASS接收到时对用户的验证进行校验。因此这些组合使ProFTPD允许多个同步Auth模块存在如modauthunix, modsql, modldap，可能导致某个验证模块提供用户数据modauthunix而另一个模块验证用户数据如modsql. 当验证模块modsql配置成使用底限制的验证策略，如： SQLAuthTypes...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-gorotto 2.0a 2006/02/08 edition, 2006/03/19 edition, and 2006/04/07 edition before 20070416 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 pub/modules/d/top.html; 2 /pub/modules/a/access.html;...

CVE-2006-7194: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SESSIONPATHCOMPOSANT parameter...

CVE-2007-2067: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Marco Antonio Islas Cruz Web Slider WebSlider 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to 1 index.php, 2 modules/pdf.php, 3 plugins/highlight.php, or 4 include/modules.php...

CVE-2007-2071: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Open-gorotto 2.0a 2006/02/08 edition, 2006/03/19 edition, and 2006/04/07 edition before 20070416 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 pub/modules/d/top.html; 2 /pub/modules/a/access.html;...

CVE-2007-2052: Off-by-one Error

Off-by-one error in the PyLocalestrxfrm function in Modules/localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due ...

Web Slider 0.6 - 'path' Remote File Inclusion

Web Slider 0.6pathRemote File Inclusion Vulnerabilities D.Script: http://sourceforge.net/projects/webslider/ Discovered by: GolDM = Mahmoodali Homepage: http://Www.Tryag.Com/cc Exploit:Path/index.php?path=Shell Exploit:Path/modules/pdf.php?path=Shell Exploit:Path/plugins/highlight.php?path=Shell...

CVE-2007-1974

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

CVE-2007-1974

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section aka WF-Sections 1.0.1, as used in Xoops modules such as 1 Zmagazine 1.0, 2 Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via...

CVE-2007-1925: Undefined Security Weakness

The borrado function in modules/YourAccount/index.php in Tru-Zone Nuke ET 3.4 before fix 7 does not verify that account deletion requests come from the account owner, which allows remote authenticated users to delete arbitrary accounts via a modified cookie...

NullSoft WinAmp multiple security vulnerabilities

Multiple memory corruptions in different modules...

CVE-2007-1807: Undefined Security Weakness

SQL injection vulnerability in modules/myalbum/viewcat.php in the myAlbum-P 2.0 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter...

Buffer Overflow in InterVetions' NaviCopa HTTP server 2.01

Buffer Overflow in InterVetions' NaviCopa HTTP server 2.01 While developing one of our advanced security training modules, we identified a remotely exploitable buffer overflow vulnerability in the latest release of InterVetions' HTTP server NaviCopa 2.01. Successful exploitation of this...

MAMBO Modules SWmenu 4.0 (ImageManager.php) Remote File Include Vulnerabilities

MAMBO Modules SWmenu 4.0 ImageManager.php Remote File Include Vulnerabilities script : http://mamboxchange.com/frs/download.php/8109/comswmenufree4.0.zip file : /ImageManager/Classes/ImageManager.php Dork : index.php?option=comswmenupro Found by & Contact : Cold z3ro , [email protected] ,...

CVE-2007-1657: Undefined Security Weakness

Stack-based buffer overflow in the filecompress function in minigzip Modules/zlib in Python 2.5 allows context-dependent attackers to execute arbitrary code via a long file argument...

joomlamambo-rfi.txt

MAMBO Modules SWmenu 4.0 ImageManager.php Remote File Include Vulnerabilities script : http://mamboxchange.com/frs/download.php/8109/comswmenufree4.0.zip file : /ImageManager/Classes/ImageManager.php Dork : index.php?option=comswmenupro Found by & Contact : Cold z3ro , [email protected] ,...