Solaris sadmind Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Solaris...

Riorey RIOS 4.7.0 - Hard-Coded Password

Severity: High Full root access to the device Date: 07 October 2009 Versions Affected: RIOS 4.6.6 , 4.7.0 possibly others Discovered on: 25 July 2009 Vendor URL: www.riorey.com Author: Marek Kroemeke Overview: Riorey DDoS mitigation appliences www.riorey.com are vulnerable to taking a full contro...

Mozilla Firefox 3 - ftp:// URL Multiple File Format Handling XSS

Mozilla Firefox 3 ftp:// URL Multiple File Format Handling XSS. CVE-2008-4723. Remote exploit for windows platform source: http://www.securityfocus.com/bid/31855/info Mozilla Firefox 3 is prone to a cross-site scripting weakness that arises because the software fails to handle specially crafted...

drupal -- multiple vulnerabilities

The Drupal Project reports: A logic error in the core upload module validation allowed unprivileged users to attach files to content. Users can view files attached to content which they do not otherwise have access to. If the core upload module is not enabled, your site will not be affected. A...

PHP 5.2.6 - create_function() Code Injection (2)

PHP 5.2.6 - createfunction Code Injection 2 source: https://www.securityfocus.com/bid/31398/info PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'createfunction'. Note that the anonymous function returned need not be called for the supplied code to be...

PHP 5.2.6 - create_function() Code Injection (1)

PHP 5.2.6 - createfunction Code Injection 1 source: https://www.securityfocus.com/bid/31398/info PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'createfunction'. Note that the anonymous function returned need not be called for the supplied code to be...

RunCMS 1.6.1 - 'bbPath[root_theme]' Remote File Inclusion

source: https://www.securityfocus.com/bid/30331/info RunCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks a...

OtomiGenX v2.2 Ultimate Authentication bypass Vulnerability

...::::: OtomiGenX v2.2 Ultimate Authentication bypass Vulnerabilities ::::.... Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my be...

RunCMS 1.6 - Local File Inclusion

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: RunCms Multiple Vulnerabilities Vendor: http://www.runcms.org/ Bugs: Local File Inclusion, Modules Authorization Weakness Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x prior versions also may be affected Exploitatio...

IBM Websphere Application Server 5.1.1 - WebContainer HTTP Request Header Security

source: https://www.securityfocus.com/bid/26457/info IBM WebSphere Application Server is prone to a security weakness regarding an HTTP request header. The software fails to sanitize a certain HTTP header when the data is redirected to an error message. An attacker may exploit this issue to steal...

Microsoft Windows Vista/2003/XP/2000 file management security issues

Title: Microsoft Windows Vista/2003/XP/2000 file management security issues Author: 3APA3A, http://securityvulns.com/ Vendor: Microsoft and potentially another vendors Products: Microsoft Windows Vista/2003/XP/2000, Microsoft resource kit for Windows 2000 and different utilities. Access Vector:...

Microsoft Windows Vista/2003/XP/2000 file management security issues

Title: Microsoft Windows Vista/2003/XP/2000 file management security issues Author: 3APA3A, http://securityvulns.com/ Vendor: Microsoft and potentially another vendors Products: Microsoft Windows Vista/2003/XP/2000, Microsoft resource kit for Windows 2000 and different utilities. Access Vector:...

GnuPG 1.x - Signed Message Arbitrary Content Injection

source: https://www.securityfocus.com/bid/22757/info GnuPG is prone to a weakness that may allow an attacker to add arbitrary content into a message without the end user knowing. An attacker may be able to exploit this issue in applications using GnuPG to add arbitrary content into a signed and/o...

Microsoft Internet Explorer 6 - Local File Access

source: https://www.securityfocus.com/bid/22621/info Microsoft Internet Explorer is reportedly prone to multiple local file-access weaknesses because the application fails to properly handle HTML tags. These issues are triggered when an attacker entices a victim user to visit a malicious website...

Apple QuickTime 7.1.3 PlugIn - Arbitrary Script Execution

Apple QuickTime 7.1.3 PlugIn - Arbitrary Script Execution source: https://www.securityfocus.com/bid/20138/info Apple QuickTime plug-in is prone to an arbitrary-script-execution weakness when executing QuickTime Media Link files .qtl. An attacker can exploit this issue to execute arbitrary script...

Apache 1.3.352.0.582.2.2 - Arbitrary HTTP Request Headers Security

Apache 1.3.352.0.582.2.2 - Arbitrary HTTP Request Headers Security source: https://www.securityfocus.com/bid/19661/info Apache HTTP server is prone to a security weakness related to HTTP request headers. An attacker may exploit this issue to steal cookie-based authentication credentials and launc...

Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security

source: https://www.securityfocus.com/bid/19661/info Apache HTTP server is prone to a security weakness related to HTTP request headers. An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks. var req:LoadVars=new LoadVars;...

[Full-disclosure] rPSA-2006-0080-1 postgresql postgresql-server

rPath Security Advisory: 2006-0080-1 Published: 2006-05-24 Products: rPath Linux 1 Rating: Severe Exposure Level Classification: Local System User Deterministic Vulnerability Updated Versions: postgresql=/conary.rpath.com@rpl:devel//1/8.1.4-1-0.1...

DistCC Daemon Command Execution

This module uses a documented security weakness to execute arbitrary commands on any system running distccd. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DistCC Daemon Command Execution',...

IMOEL CMS Sql password discovery

IMOEL CMS has the weakness to download the plain text sql password in the setting.php file / $setting'host''username' = 'sqlusername'; $setting'host''password' = 'sqlpassword'; so u can download the setting.php file & view the plain text password as the default imoel cms set the administrator use...