6783 matches found
Obtaining user list in PHP safe mode
Unlimited access to getpw allows to reconstruct full users list...
Bypassing safe mode in PHP
It's possible to bypass safe mode limitation by using moveuploadedfile call and MySQL library functions to access files of different users...
CVE-2002-0127: Undefined Security Weakness
Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26, when configured to block traffic below port 1024, allows remote attackers to cause a denial of service hang via a port scan of the WAN port...
PHP Safe Mode Filesystem Circumvention Problem
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ------------------------------------------------------------------------------ Security Advisory DW020203-PHP Release: 3rd February 2002 PHP Safe Mode Filesystem Circumvention Problem Severity: Medium to high. Affects: PHP, all versions which include...
PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (3)
optionsMYSQLIOPTLOCALINFILE, 1; $m-setlocalinfilehandler"r"; $m-query"LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a"; $m-close; ?...
CVE-2001-0984
Vulnerability summary: Password Safe 1.7(1) leaves cleartext passwords in memory when a user copies a password to the clipboard and minimizes the application with the options “Clear the password when minimized” and “Lock password database on minimize and prompt on restore” enabled. This could all...
CVE-2001-0984
Password Safe 1.71 leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with acce...
CVE-2001-0984: Undefined Security Weakness
Password Safe 1.71 leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with acce...
Eyedog ActiveX control incorrectly marked "safe for scripting"
Overview Versions of the Eyedog ActiveX control current circa August, 1999, are incorrectly marked safe for scripting. Description Eyedog is an ActiveX control that was used to perform diagnostic function in Windows. It was marked as safe for scripting, which means that it could be called from...
leak of information in counterpane/Bruce Schneier's Password Safe program
Background : Password Safe http://www.counterpane.com/passsafe.html is a free win9x/2000 utility used to keep all your passwords encrypted on hdd using Bruce Schneier's symmetric algorithm blowfish. Version tested : 1.71 Vulnerability : Password Safe has an option I think is default to "lock...
CVE-2001-0984
Password Safe 1.71 leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with acce...
CVE-1999-1206
The CVE-1999-1206 issue concerns SystemSoft SystemWizard on HP Pavilion PCs running Windows 98, where two ActiveX controls (LaunchCtrl and RegistryAccess) marked as safe-for-scripting can be used by a malicious web page to execute arbitrary commands. The vulnerabilities are tied to the Registry O...
PHP Safe Mode mail Function 5th Parameter Arbitrary Command Execution
The remote host is running PHP 4.0.5. There is a flaw in this version of PHP that allows local users to circumvent the safe mode and to gain the UID of the HTTP process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: Date: Fri, 23 Aug 2002 09:30:40 +0200 CEST From: "Wojciech...
CVE-2001-1246
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters...
PT-2001-2378 · Php · Php
Name of the Vulnerable Software and Affected Versions: PHP versions 4.0.5 through 4.1.0 Description: The issue is related to the mail function in PHP, where the 5th parameter is not properly cleansed in safe mode, allowing local users and possibly remote attackers to execute arbitrary commands vi...
bugtraq submission
All versions of the C version of ePerl 2.2 up to current version 2.2.14 http://www.engelschall.com/sw/eperl/ Severity: Low Systems Affected: Unix systems Description: ePerl allows the user to embed perl code specified inside ePerl delimiters in HTML. ePerl has the ability to "safely" include...
RhinoSoft FTP Voyager FtpTree incorrectly marked "safe for scripting"
Overview FTP Voyager is an FTP client implemented as an ActiveX control. It is incorrectly marked as "safe for scripting" allowing malicious web pages or email messages to upload and download files. Description FTP Voyager is an FTP client implemented as an ActiveX control. An ActiveX control may...
A Stateful Inspection of FireWall-1
A Stateful Inspection of FireWall-1 Thomas Lopatic, John McDonald TUV data protect GmbH tl,[email protected] Dug Song Center for Information Technology Integration University of Michigan [email protected] 1 Introduction -------------- At the Black Hat Briefings 2000, we presented an analysis of...
CVE-2000-0419
The Office 2000 UA ActiveX control is described as wrongly marked “safe for scripting.” This vulnerability allows an intruder to script interactions through the control’s Show Me feature, potentially disabling macro warnings and enabling arbitrary actions within Office applications (e.g., launchi...