PT-2017-10762

Name of the Vulnerable Software and Affected Versions Elixir Plug versions prior to 1.0.4 Elixir Plug versions prior to 1.1.7 Elixir Plug versions prior to 1.2.3 Elixir Plug versions prior to 1.3.2 Description The issue concerns null byte injection in the Plug.Static component, which may allow...

WP Rocket <= 2.10.3 - Local File Inclusion (LFI)

Requires older versions of PHP that are vulnerable to null byte injection...

Remote Code Execution (RCE)

glassfish web-core is susceptible to remote code execution. It does not prevent NULL \0 byte injection in repository path of PartItem, allowing potential file manipulation via Java object deserialization. Moreover, it does not validate the existence of the NULL \0 byte when an older Java VM is...

onArcade 2.4.x Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: onArcade 2.4.x Local File Get Contents Vulnerability Google Dork: inurl:"cup.php?a=all" Date: 23 Mar 2017 Exploit Author: Deyaa Muhammad Author Mail: contact at deyaa.me Exploit Blog:...

CVE-2016-8005

File extension filtering vulnerability in Intel Security McAfee Email Gateway MEG before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension...

Directory traversal

A directory traversal vulnerability in the web application in McAfee now Intel Security SaaS Control Console SCC Platform 6.14 before patch 1070, and 6.15 before patch 1076 allows unauthenticated users to view contents of arbitrary system files that did not have file system level read access...

Design/Logic Flaw

File extension filtering vulnerability in Intel Security McAfee Email Gateway MEG before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension...

CVE-2016-8005

CVE-2016-8005 is a file-extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) prior to 7.6.404h1128596. An attacker can bypass proper filename detection by forging a filename with a null byte in the extension, as described in NVD and relatedOpenVAS entries. Affected produ...

CVE-2016-8005: Undefined Security Weakness

File extension filtering vulnerability in Intel Security McAfee Email Gateway MEG before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension...

CVE-2013-7462: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the web application in McAfee now Intel Security SaaS Control Console SCC Platform 6.14 before patch 1070, and 6.15 before patch 1076 allows unauthenticated users to view contents of arbitrary system files that did not have file system level read access...

PT-2017-5764

Name of the Vulnerable Software and Affected Versions: McAfee SaaS Control Console SCC Platform versions 6.14 through 6.14 before patch 1070 McAfee SaaS Control Console SCC Platform versions 6.15 through 6.15 before patch 1076 Description: A directory traversal issue in the web application allows...

PT-2017-9455

Name of the Vulnerable Software and Affected Versions Intel Security McAfee Email Gateway MEG versions prior to 7.6.404h1128596 Description A file extension filtering issue allows attackers to bypass proper file name identification by scanning an email with a forged attached filename that uses a...

PHP 7.1.0 / 5.6.29 missing null byte checks for paths in ZipArchive::extractTo Vulnerability

Exploit for php platform in category dos / poc Description: ------------ ZipArchive-extractTo doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the directory path. Affected method: ------------------------------------------ static ZIPARCHIVEMETHODextractTo...

PHP 7.1.0 / 5.6.29 missing null byte checks for paths in curl_file_create() Vulnerability

Exploit for php platform in category dos / poc Description: ------------ Missing null byte checks for paths in curlfilector curlfilecreate doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the upload file name and path. Affected code:...

PHP 7.1.0 / 5.6.29 missing null byte checks for paths in exif_imagetype Vulnerability

Exploit for php platform in category dos / poc Description: ------------ exifimagetype doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the file path. =============================================== Affected code: PHPFUNCTIONexifimagetype char imagefile; size...

CVE-2016-4296: Improper Restriction of Operations within the Bounds of a Memory Buffer

When opening a Hangul Hcell Document .cell and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore "" character at the end of the string and write a null terminator after it. If the character is at the very end of the string, the application wil...

Null Byte Corruption

bson is vulnerable to null byte corruptions. A malicious user can insert a null byte into a cstring when encoding, terminating the string prematurely. This can lead to security issues such as buffer overflows...

DEBIAN-CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

ALPINE-CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...