CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...

CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...

CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...

CVE-2007-5034

CVE-2007-5034 affects ELinks prior to 0.11.3. When sending a POST over HTTPS via a proxy, the body and headers of the POST are appended to the CONNECT request in cleartext, enabling potential disclosure of sensitive data. Impact: information disclosure via TLS-protected traffic when a HTTPS proxy...

CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...

Flip 3.0 - Remote Admin Creation

Flip 3.0 - Remote Admin Creation !/usr/bin/perl use strict; use IO::Socket; use Getopt::Std; my $app = "Flip ; print "password you want: "; my $pass = ; chomp$user; chomp$pass; createadmin$url, $user, $pass; sub createadmin my $url = shift; my $user = shift; my $pass = shift; print "creating admi...

GForge 4.6b2 - skill_delete SQL Injection

GForge 4.6b2 - skilldelete SQL Injection Sql Injection Vulnerability In GForge Portcullis Security Advisory 07-014 Vulnerable System: All current versions till 4.6b2 Vulnerability Title: Sql Injection Vulnerability Discovery and Development: Portcullis Security Testing Services. Credit for...

CVE-2007-4625

Polipo before 1.0.2 allows remote HTTP servers to cause a denial of service daemon crash by aborting the response to a POST request...

CVE-2007-4625

Removed by vendor...

phpnukesearch-xss.txt

PHP-Nuke ALL versions Search Module multiple XSS and HTML injection ------------------------------------------------------------------- The well-known PHP-Nuke CMS is vulnerable to multiple XSS attacks and HTML injections through the Search Module. The request is made using POST, but the whole...

molyx board X_UP_CALLING_LINE_ID sql injection Remote Privilege Exploit

No description provided by source. molyx board XUPCALLINGLINEID sql injection Remote Privilege Exploit !/usr/bin/perl -w use IO::Socket; PROOF-OF-CONCEPT work only with php5 or php4&&GPC=off Example: C:\mlexp.pl 127.0.0.1 /bbs/ 1 prepare to connect... + connected prepare to send data... + OK...

CVE-2007-3957

Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request with a long URI...

Buffer overflow

Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request with a long URI...

CVE-2007-3957

The vulnerability CVE-2007-3957 affects the Nipun Jain xserver 0.1 alpha project. It is described as a buffer overflow in the server that allows remote attackers to cause a denial of service by sending a POST request with a long URI. The connected documents reiterate the same description and do n...

[Full-disclosure] ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content

Advisory: ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content RedTeam Pentesting discovered a design vulnerability in the page editor of the activeWeb contentserver CMS during a penetration test. Filtering of user content, e.g. to prevent the usage of Javascript code, is done ...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

Cross site request forgery (csrf)

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

CVE-2007-3570

The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...

MySQLDumper Apache访问控制验证绕过漏洞

MySQLDumper是一款备份MySQL数据库的备份脚本。 在Apache访问控制文件中存在配置错误，远程攻击者可以利用漏洞绕过验证删除Apache的访问控制文件，获得对保护文件的访问。 由于MySQLDumper包含的main.php对用户提交的 HTTP POST请求缺少验证，攻击者可以利用漏洞删除.htaccess/.htpasswd文件，访问受保护的文件信息。 MySQLDumper MySQLDumper Typo3-Extension 0.0.5 MySQLDumper MySQLDumper 1.23prereleaseREV MySQLDumper MySQLDumpe...

dreamlog-upload.txt

? / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ / --------------------------------------------------------------------- !...