CVE-2012-2751

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform...

Buffer overflow

Unspecified vulnerability in the phpstreamscandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."...

LFI local include exploit tips-vulnerability warning-the black bar safety net

0×0 0 digression Hey Hey, hope that you get to explore technology. 0×0 1 PHP Input/Ouput Wrapper remote include function command execution Details: the PHP includefunction there is a design flaw, a remote attacker can exploit this vulnerability may be in the WEB permissions to execute arbitrary...

php-pecl-apc: potential XSS in apc.php

Cross-site scripting XSS vulnerability in apc.php in the Alternative PHP Cache APC extension before 3.1.4 for PHP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2924

PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

PHP 5.4.3 - com_event_sink Denial of Service

PHP 5.4.3 - comeventsink Denial of Service ?php / PHP = 5.4.3 comeventsink Code Execution Proof of Concept Found by condis Website: http://cond.psychodela.pl Tested on: PHP 5.3.8 + Windows XP SP3 Professional PL PHP 5.3.10 + Windows XP SP3 Professional PL PHP 5.4.0 + Windows XP SP3 Professional P...

PHP 5.4.3 com_event_sink Denial Of Service

?php / PHP = 5.4.3 comeventsink Code Execution Proof of Concept Found by condis Website: http://cond.psychodela.pl Tested on: PHP 5.3.8 + Windows XP SP3 Professional PL PHP 5.3.10 + Windows XP SP3 Professional PL PHP 5.4.0 + Windows XP SP3 Professional PL PHP 5.4.3 + Windows XP SP3 Professional P...

SOL13588 - PHP vulnerability CVE-2011-4885

Recommended action BIG-IP To mitigate this vulnerability, expose the administrative interface only on trusted networks and limit login access to trusted users. FirePass For information about hotfix status, contact F5 Technical Support. Supplemental Information CVE-2011-4885 SOL9970: Subscribing t...

Design/Logic Flaw

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgimain.c component and a query string beginning with a +...

EUVD-2012-2329

sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing command-line options...

Andromeda Streaming MP3 Server 1.9.3.6 Cross Site Scripting

Andromeda Streaming MP3 Server v1.9.3.6 s param Remote XSS Vulnerability Vendor: Turnstyle Product web page: http://www.turnstyle.com Affected version: 1.9.3.6 PHP 2012 Summary: Turn your MP3 collection into an MP3 server. Simply add a single PHP or ASP script to any folder within your site. Now...

PT-2012-1212

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.12 PHP versions 5.4.x prior to 5.4.2 Description The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code ...

Serious Remote PHP Bug Accidentally Disclosed

A serious remote-code execution vulnerability in PHP was accidentally disclosed Wednesday, leading to fears of an outbreak of attacks on sites that were built using vulnerable versions of PHP. The bug has been known privately since January when a team of researchers used it in a capture the flag...

Gilbert Life SQL Injection

Exploit Title: Gilbert Life SQL Ýnjecktion Author: Th4 MasK Sofware Website : http://www.gilbertlife.com Date : 09.04.2012 Platform : Php Dork : © 2010 GilbertLife // Demo Site : http://www.gilbertlife.com/subdetails.php?id=11SQL Greetz: http://th4mask.blogspot.com DarkDevilZ.iN Contact to ;...

Google V8 Server-Side JavaScript Injection joins the set of web application security vulnerabilitie

No description provided by source. Google V8 Server-Side JavaScript Injection joins the set of web application security vulnerabilities TIME-BASED PHP V8JS INJECTION & NOSQL/SSJS INJECTION Detecting server-side JavaScript SSJS injection vulnerabilities using time-based techniques. Article by Feli...

PHP 5.4.0RC6 Denial Of Service

RHEL, CentOS gdb c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x00007fd959ca5f9d in zendhashindexupdateornextinsert ht=0x7fd96480d508, h=0, pData=0x7fff75c47bd0, nDataSize=8, pDest=0x7fff75c47bc8, flag=1, zendfilename=0x7fd95a061b68...

Remote file inclusion

PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter...

Stack overflow

Stack-based buffer overflow in the suhosinencryptsinglecookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long...

SOL13279 - PHP vulnerability CVE-2009-4017

Recommended Action None Supplemental Information Note: This link will take you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge. SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view n...

Posse Softball Director CMS - team.php Blind SQL Injection

Posse Softball Director CMS - team.php Blind SQL Injection .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-. Posse Softball Director CMS Blind SQL Injection Vulnerability team.php .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-. + Autor:...