CVE-2006-5613

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler mp3SDS 3.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter...

CVE-2006-5613

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler mp3SDS 3.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter...

CVE-2006-5613

CVE-2006-5613 affects MP3 Streaming DownSampler (mp3SDS) 3.0. The vulnerability is a PHP remote file inclusion in Core/core.inc.php when register_globals is enabled, allowing an attacker to execute arbitrary PHP code via the fullpath parameter. The issue is documented across multiple sources (NVD...

EUVD-2006-5598

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler mp3SDS 3.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the fullpath parameter...

Debian DSA-901-1 : gnump3d - programming error

Several vulnerabilities have been discovered in gnump3d, a streaming server for MP3 and OGG files. The Common Vulnerabilities and Exposures Project identifies the following problems : - CVE-2005-3349 Ludwig Nussel discovered several temporary files that are created with predictable filenames in a...

Debian DSA-877-1 : gnump3d - XSS, directory traversal

Steve Kemp discovered two vulnerabilities in gnump3d, a streaming server for MP3 and OGG files. The Common Vulnerabilities and Exposures Project identifies the following problems : - CVE-2005-3122 The 404 error page does not strip malicious JavaScript content from the resulting page, which would ...

CVE-2006-3367

Mp3 JudeBox Server (Mp3NetBox) Beta 1 stores config.inc under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information including the database configuration. This CVE (CVE-2006-3367) is documented across multiple sources (NVD/NVD CVE list) a...

mp3com.txt

mp3.com - Cross site scripting vulnerability ---------------------------------------------- Type: Cross site scripting Date: June, 15th 2006 ---------------------------------------------- Credits: ---------------------------------------------- Discovered by: David "Aesthetico" Vieira-Kurz...

mp3search.txt

MP3 Search/Archive v1.2 Homepage: http://www.bloodys.com Affected files: Search input box. index.php Data is not properally sanatized before its generated. For PoC try putting the code below in the search box: Screenshots: http://www.youfucktard.com/xsp/mp3search.jpg XSS vuln via res variable on...

CVE-2006-3071

CVE-2006-3071 describes a cross-site scripting (XSS) vulnerability in index.php of MP3 Search/Archive 1.2, allowing an attacker to inject arbitrary script or HTML via the 1) keywords parameter used by the search box, and 2) res parameter. The provided sources identify the flaw but do not include ...

MP3 Search/Archive v1.2 - XSS

MP3 Search/Archive v1.2 Homepage: http://www.bloodys.com Affected files: Search input box. index.php Data is not properally sanatized before its generated. For PoC try putting the code below in the search box: SCRIPT SRC=http://youfucktard.com/xss.js/SCRIPT Screenshots:...

Mandrake Linux Security Advisory : mpg123 (MDKSA-2006:092)

An unspecified vulnerability in mpg123 0.59r allows user-complicit attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3. Packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SHOUTcast filename format string vulnerability

Added: 05/17/2006 CVE: CVE-2004-1373 BID: 12096 OSVDB: 12585 Background SHOUTcast is a streaming audio server based on Winamp. Problem A format string vulnerability in SHOUTcast allows remote attackers to execute commands by requesting a MP3 filename containing format string characters such as %n...

SHOUTcast filename format string vulnerability

Added: 05/17/2006 CVE: CVE-2004-1373 BID: 12096 OSVDB: 12585 Background SHOUTcast is a streaming audio server based on Winamp. Problem A format string vulnerability in SHOUTcast allows remote attackers to execute commands by requesting a MP3 filename containing format string characters such as %n...

SHOUTcast filename format string vulnerability

Added: 05/17/2006 CVE: CVE-2004-1373 BID: 12096 OSVDB: 12585 Background SHOUTcast is a streaming audio server based on Winamp. Problem A format string vulnerability in SHOUTcast allows remote attackers to execute commands by requesting a MP3 filename containing format string characters such as %n...

SHOUTcast filename format string vulnerability

Added: 05/17/2006 CVE: CVE-2004-1373 BID: 12096 OSVDB: 12585 Background SHOUTcast is a streaming audio server based on Winamp. Problem A format string vulnerability in SHOUTcast allows remote attackers to execute commands by requesting a MP3 filename containing format string characters such as %n...

CVE-2006-2230

Multiple format string vulnerabilities in xiTK xitk/main.c in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack...

CVE-2006-2230

Multiple format string vulnerabilities in xiTK xitk/main.c in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack...

Format string

Multiple format string vulnerabilities in xiTK xitk/main.c in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack...

CVE-2006-2230

CVE-2006-2230 affects xine-ui (the xine viewer UI) and is described as multiple format string vulnerabilities in xiTK/main.c of xine 0.99.4 that can cause a denial of service via a filename argument. Public references in Debian and OpenVAS advisories confirm a format-string issue exploitable loca...