GeoIP GeoIPUpdate.C目录遍历漏洞

GeoIP是一款用于识别Web网站访问者的所在国家应用软件。 GeoIP不正确处理用户提交的请求，远程攻击者可以利用漏洞以进程权限查看系统文件内容。 问题是由于对'updategetfilename'提交的数据缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以应用程序进程权限执行任意指令。 Maxmind geopip 0 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 目前没有解决方案提供： http://www.maxmind.com/app/locate...

1WebCalendar v 4.x vuln.

1WebCalendar v 4.x vuln. Vuln. discovered by : r0t Date: 22 march 2006 vendor:www.bensonitsolutions.com/calendar/v4/ affected version: v4.0 and prior orginal advisory: http://pridels.blogspot.com/2006/03/1webcalendar-v-4x-vuln.html Vuln.desc. 1WebCalendar contains a flaw that allows a remote sql...

CVE-2005-1937

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by...

CVE-2003-0391

The CVE-2003-0391 entry describes a format-string vulnerability in Magic WinMail Server 2.3 (and possibly other 2.x versions) that allows remote attackers to crash the service and potentially execute arbitrary code via format specifiers processed in the PASS/USER flow. The weakness occurs when ha...