4737 matches found
PHP 5.4.3 com_event_sink Denial Of Service
?php / PHP = 5.4.3 comeventsink Code Execution Proof of Concept Found by condis Website: http://cond.psychodela.pl Tested on: PHP 5.3.8 + Windows XP SP3 Professional PL PHP 5.3.10 + Windows XP SP3 Professional PL PHP 5.4.0 + Windows XP SP3 Professional PL PHP 5.4.3 + Windows XP SP3 Professional P...
SOL13588 - PHP vulnerability CVE-2011-4885
Recommended action BIG-IP To mitigate this vulnerability, expose the administrative interface only on trusted networks and limit login access to trusted users. FirePass For information about hotfix status, contact F5 Technical Support. Supplemental Information CVE-2011-4885 SOL9970: Subscribing t...
Design/Logic Flaw
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgimain.c component and a query string beginning with a +...
EUVD-2012-2329
sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing command-line options...
Andromeda Streaming MP3 Server 1.9.3.6 Cross Site Scripting
Andromeda Streaming MP3 Server v1.9.3.6 s param Remote XSS Vulnerability Vendor: Turnstyle Product web page: http://www.turnstyle.com Affected version: 1.9.3.6 PHP 2012 Summary: Turn your MP3 collection into an MP3 server. Simply add a single PHP or ASP script to any folder within your site. Now...
PT-2012-1212
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.12 PHP versions 5.4.x prior to 5.4.2 Description The issue arises from insufficient input validation in the sapi/cgi/cgi main.c component of the PHP interpreter. This allows remote attackers to execute arbitrary code ...
Serious Remote PHP Bug Accidentally Disclosed
A serious remote-code execution vulnerability in PHP was accidentally disclosed Wednesday, leading to fears of an outbreak of attacks on sites that were built using vulnerable versions of PHP. The bug has been known privately since January when a team of researchers used it in a capture the flag...
Gilbert Life SQL Injection
Exploit Title: Gilbert Life SQL Ýnjecktion Author: Th4 MasK Sofware Website : http://www.gilbertlife.com Date : 09.04.2012 Platform : Php Dork : © 2010 GilbertLife // Demo Site : http://www.gilbertlife.com/subdetails.php?id=11SQL Greetz: http://th4mask.blogspot.com DarkDevilZ.iN Contact to ;...
Google V8 Server-Side JavaScript Injection joins the set of web application security vulnerabilitie
No description provided by source. Google V8 Server-Side JavaScript Injection joins the set of web application security vulnerabilities TIME-BASED PHP V8JS INJECTION & NOSQL/SSJS INJECTION Detecting server-side JavaScript SSJS injection vulnerabilities using time-based techniques. Article by Feli...
PHP 5.4.0RC6 Denial Of Service
RHEL, CentOS gdb c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x00007fd959ca5f9d in zendhashindexupdateornextinsert ht=0x7fd96480d508, h=0, pData=0x7fff75c47bd0, nDataSize=8, pDest=0x7fff75c47bc8, flag=1, zendfilename=0x7fd95a061b68...
Remote file inclusion
PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter...
Stack overflow
Stack-based buffer overflow in the suhosinencryptsinglecookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long...
SOL13279 - PHP vulnerability CVE-2009-4017
Recommended Action None Supplemental Information Note: This link will take you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge. SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view n...
Posse Softball Director CMS - team.php Blind SQL Injection
Posse Softball Director CMS - team.php Blind SQL Injection .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-. Posse Softball Director CMS Blind SQL Injection Vulnerability team.php .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-. + Autor:...
Stanford.edu Cross Site Scripting
Exploit Title: Stanford.edu Cross Site Scripting Vulnerability Date: 12/11/2011 - 04:00am Author: Ryuzaki Lawlet Website: http://jusryuz.blogspot.com Tested On: WinXP /Win7 Platform: php Email: [email protected] $ Vulnerable : http://www.domain.edu/Ryu/Ryuz/cgi-bin/index.php?photos&event= $...
PHP Vulnerability Hunter v.1.1.4.6 - Automated fuzz testing tool
PHP Vulnerability Hunter v.1.1.4.6 - Automated fuzz testing tool This is the application that detected almost all of the web application vulnerabilities listed on the advisories page. PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool capable of triggering a wide range o...
PHP Vulnerability Hunter v.1.1.4.6 - Automated fuzz testing tool
PHP Vulnerability Hunter v.1.1.4.6 - Automated fuzz testing tool This is the application that detected almost all of the web application vulnerabilities listed on the advisories page. PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool capable of triggering a wide range o...
CVE-2011-4078
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...
php: Crash by converting serial day numbers (SDN) into Julian calendar
Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service application crash via a large integer in the first argument to the calfromjd function...
