KB-Bestellsystem - kb_whois.cgi Command Execution

KB-Bestellsystem - kbwhois.cgi Command Execution "KB-Bestellsystem" is a domain order system written in Perl. The "domain" and "tld" parameters in "kbwhois.cgi" are not filtering shell metacharacters. The following examples will show you the /etc/passwd file:...

KB-Bestellsystem - 'kb_whois.cgi' Command Execution

"KB-Bestellsystem" is a domain order system written in Perl. The "domain" and "tld" parameters in "kbwhois.cgi" are not filtering shell metacharacters. The following examples will show you the /etc/passwd file:...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-297-1)

Jonas Sicking discovered that under some circumstances persisted XUL attributes are associated with the wrong URL. A malicious website could exploit this to execute arbitrary code with the privileges of the user. MFSA 2006-35, CVE-2006-2775 Paul Nickerson discovered that content-defined setters o...

GLSA-200710-18 : util-linux: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200710-18 util-linux: Local privilege escalation Ludwig Nussel discovered that the checkspecialmountprog and checkspecialumountprog functions call setuid and setgid in the wrong order and do not check the return values, which can...

openSUSE 10 Security Update : pptpd (pptpd-4252)

This update fixes a bug found by regression tests. The error appears in code processing out-of-order sequence numbers of some MPPE implementations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

DEBIAN-CVE-2007-5191

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

CVE-2007-5191

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

No title provided

EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbgcreatelistener, which allows remote authenticated users to cause a denial of service daemon crash and possibly execute arbitrary code via a SELECT statement that invokes a...

[SECURITY] [DSA 1288-2] New pptpd packages fix regression

-------------------------------------------------------------------------- Debian Security Advisory DSA 1288-2 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 2nd, 2007 http://www.debian.org/security/faq -...

joblister-sql.txt

JobLister3 by SkilMatch Staffing Systems, Inc. Multiple SQL injection vulnerabilities http://www.dubdubdub.com/ http://www.skilmatch.com/ The search form filed doesnt strip special characters that have special meanings. A single quote makes the application spit out a number of errors. This is not...

DynamicData(dms)Document&Article Script /dm_browse.asp.asp sql injection

DynamicDatadmsDocument&Article Script /dmbrowse.asp.asp sql injection Credit : CodeXpLoder'tq mail : codexploderathotmaildotcom site : Biyosecurity.net,expw0rm.com thx : BiyoSecurityTeam all members thx 3APA3A spec.note : "Live The Life" 1- example.com/patch/dmbrowse.asp?pid=sql methot 1-...

Joomla! com_content Component 'order' Parameter XSS

The version of Joomla! running on the remote host is affected by a cross-site scripting XSS vulnerability in comcontent/content.php due to improper sanitization of user-supplied input to the 'order' parameter before using it to generate dynamic HTML content. An unauthenticated, remote attacker ca...

LinPHA < 1.3.2 SQL Injection Vulnerability

Binary data 4150.prm...

CVE-2007-2962

Cross-site scripting XSS vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the order parameter...

Vulnerability - cpCommerce - XSS

cpcommerce is a FOSS php-based e-commerce shopping cart web application. Exploit: Javascript placed inside a user's "Full Name:" field will not be stripped - it will be added to the database 'as-is' as long as it has no quotations in the string. When the admin goes to the clients view page, the...

DEBIAN-CVE-2007-0244

pptpgre.c in PoPToP Point to Point Tunneling Server pptpd before 1.3.4 allows remote attackers to cause a denial of service PPTP connection tear-down via 1 GRE packets with out-of-order sequence numbers or 2 certain GRE packets that are processed using a wrong pointer and improperly dequeued...

CVE-2007-0244

pptpgre.c in PoPToP Point to Point Tunneling Server pptpd before 1.3.4 allows remote attackers to cause a denial of service PPTP connection tear-down via 1 GRE packets with out-of-order sequence numbers or 2 certain GRE packets that are processed using a wrong pointer and improperly dequeued...

Fedora Core 6 : gimp-2.2.14-5.fc6 (2007-489)

The GIMP package in Fedora includes a helper script /usr/sbin/gimp-plugin-mgr for plugins contained in other packages, for example, xsane-gimp. This script manages symlinks from the GIMP plugin directory which may change between upgrades to the actual location of the plugins. A bug has been fixed...

Link Layer Topology Discovery (LLTD) Detection

The remote host responds to the LLTD Link Layer Topology Discovery protocol. This protocol can be used to enumerate the IPv4 and IPv6 addresses of a remote host, its name, the characteristics of the physical layer it is connected to, as well as the topology of the network, etc... This plugin...

Directory traversal

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...