WWWboard password disclosure

//A vulnerability found in WWWboard that shows the administrative user names and passwords. Althought the password is hashed, It can easily be decoded. //Effected versions: Version 2.0 ALPHA 2 //File name: passwd.txt //File location: http://victim/wwwboard/passwd.txt //Google dork:...

php imap_mail_compose() buffer overflow via type.parameters

Buffer overflow in the imapmailcompose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411, it appears that this issue might be subsumed by CVE-2007-0906.3...

Directory traversal

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

EUVD-2007-0868

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2007-0872: Undefined Security Weakness

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

DEBIAN-CVE-2007-0458

Unspecified vulnerability in the HTTP dissector in Wireshark formerly Ethereal 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service application crash via unspecified vectors, a different issue than CVE-2006-5468...

PHP-Nuke Block-Old_Articles.PHP SQL注入漏洞

PHP-Nuke是一款基于PHP的站点构架程序。 PHP-Nuke不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Block-OldArticles.PHP'脚本对用户提交的'cat'参数缺少过滤，提交恶意脚本代码作为参数数据，可导致获得敏感信息。 PHP-Nuke 7.9 PHP-Nuke 7.8 PHP-Nuke 7.7 PHP-Nuke 7.6 PHP-Nuke 7.5 PHP-Nuke 7.4 PHP-Nuke 7.3 PHP-Nuke 7.2 PHP-Nuke 7.1 PHP-Nuke 7.0 目前没有解决方案提供：...

PHP-Nuke <= 7.9 Old-Articles Block "cat" SQL Injection vulnerability

/ -------------------------------------------------------- Neo Security Team NST - Advisory 31 - 2007-01-13 -------------------------------------------------------- Program: PHP-Nuke Homepage: http://www.phpnuke.org Vulnerable Versions: PHP-Nuke = 7.9 Risk: Medium Impact: Medium Risk -==PHP-Nuke ...

security flaw

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption...

[ MDKSA-2006:212 ] - Updated doxygen packages to fix embedded libpng vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:212 http://www.mandriva.com/security/ Package : doxygen Date : November 16, 2006 Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0 Problem Description: Doxygen is a documentation system for C, C++ and...

Debian DSA-956-1 : lsh-server - filedescriptor leak

Stefan Pfetzing discovered that lshd, a Secure Shell v2 SSH2 protocol server, leaks a couple of file descriptors, related to the randomness generator, to user shells which are started by lshd. A local attacker can truncate the server's seed file, which may prevent the server from starting, and wi...

Debian DSA-1075-1 : awstats - programming error

Hendrik Weimer discovered that awstats can execute arbitrary commands under the user id the web-server runs when users are allowed to supply arbitrary configuration files. Even though, this bug was referenced in DSA 1058 accidentally, it was not fixed yet. The new default behaviour is not to acce...

PT-2006-4708 · Vanilla · Vanilla Cms

Name of the Vulnerable Software and Affected Versions: Vanilla CMS versions 1.0.1 and earlier Description: The issue concerns a remote file inclusion vulnerability in the upgrader.php file of Vanilla CMS. This vulnerability can be exploited when the /conf/old settings.php file exists, allowing...

DSA-981-1 bmv - integer overflow

Bulletin has no description...

xmbforums.txt

Hello This is Xss in the old versions and html injection in the new versions of xmb forums .. Discovered By : HACKERS PAL injected file u2u.php as the below u2u.php?action=send&username=|Html Injection OR XSS Thanks ,,...

Debian DSA-862-1 : ruby1.6 - programming error

Yutaka Oiwa discovered a bug in Ruby, the interpreter for the object-oriented scripting language, that can cause illegal program code to bypass the safe level and taint flag protections check and be executed. The following matrix lists the fixed versions in our distributions : old stable woody...

[SECURITY] [DSA 858-1] New xloadimage packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 858-1 [email protected] http://www.debian.org/security/ Martin Schulze October 10th, 2005 http://www.debian.org/security/faq -...

DEBIAN-CVE-2005-3166

Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service corruption of the previous submission via a crafted URL...

security flaw

The rosertioctl function in roseroute.c for Radionet Open Source Environment ROSE in Linux 2.6 kernels before 2.6.12, and 2.4 before 2.4.29, does not properly verify the ndigis argument for a new route, which allows attackers to trigger array out-of-bounds errors with a large number of digipeats...

Oracle OraClient Component Insecure Installation Issue

Secunia Advisory: SA16577 Release Date: 2005-09-06 Critical: Less critical Impact: System access Where: From remote Solution Status: Unpatched Software: Oracle Database Server 10g Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it. Description: Harr...