Directory traversal

include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...

CVE-2007-0585

include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...

CVE-2007-0585

include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...

EUVD-2007-0583

include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...

CVE-2007-0585

CVE-2007-0585 concerns Webfwlog before 0.92: when register_globals is on, remote attackers can request conffile parameters via include/debug.php to obtain source code of files, with potential directory traversal implications. The connected documents corroborate the description but do not provide ...

CVE-2007-0585: Undefined Security Weakness

include/debug.php in Webfwlog 0.92 and earlier, when registerglobals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct...

New MS07004 web Trojan source code-bug warning-the black bar safety net

html xmlns:v="urn:schemas-microsoft-com:vml" head object id="VMLRender" classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E" /object style v: behavior: urlVMLRender; /style /head body SCRIPT language="javascript" setTimeout"document. location. reloadfalse",2 0 0 0; shellcode...

[SA23865] Enthusiast Cross-Site Scripting and SQL Injection

TITLE: Enthusiast Cross-Site Scripting and SQL Injection SECUNIA ADVISORY ID: SA23865 VERIFY ADVISORY: http://secunia.com/advisories/23865/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: Enthusiast 3.x http://secunia.com/product/13303...

[x0n3-h4ck] sabros.us 1.7 XSS Exploit

-=--------------------ADVISORY-------------------=- sabros.us 1.7 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: sabros.us -=+ Version: 1.7 -=+ Vendor's URL: http://sourceforge.net/projects/sabrosus/ -=+ Platform: WindowsLinuxUnix -=+ Bug...

GnuPG包含多个安全漏洞

GnuPG是一款开放源代码的PGP加密、解密、签名工具。 GnuPG存在多个未明安全问题，远程攻击者可以利用漏洞可能以应用程序进程权限执行任意指令。 这些问题只是可能存在的问题，因此这些问题的发现是由于代码审核后对代码进行增加一些代码检查和其他源代码的修补。根据报告可能由于整数溢出和缓冲区溢出错误而造成代码执行。 GNU Privacy Guard 1.4.6 目前没有解决方案提供： http://www.gnupg.org/...

Fedora Core 6 : mono-1.1.17.1-4.fc6 (2007-067)

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. After upgrading the packages you need to...

[Full-disclosure] gnupg diff available

Hi! I did a gnupg audit recently. I was, frankly, appalled by the code quality. It is a desert of pointer manipulation, string copying, memcpy and strcpy are used all over the place, and sprintf, too. You can find my diff at http://dl.fefe.de/gnupg.dif Please note that a I might have missed...

iDefense Security Advisory 01.09.07: Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability

Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is...

Adobe Macromedia ColdFusion source code leak

Adding twice encoded NULL byte to path allows .CFM file content disclosure...

gb03-db.txt

Discovered by:Aria-Security Team Type:Remote Password Disclosure Download: http://www.planet-source-code.com/vb/scripts/ShowCode.asp?lngWId=4&txtCodeId=6847 PoC: target/path/db/gbook.mdb target/path/db/gbook97.mdb Contact: [email protected]...

CVE-2006-5858

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...

SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit

Inge Henriksen Security Advisory - Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/ Advisory Name: SoftArtisans FileUpTM viewsrc.asp remote script source disclosure exploit Tested and Confirmed Vulerable: SoftArtisans SAFileUpTM 5.0.14 Standard Severity: High Type: Script...

About the database the simple intrusion and rogue damage-vulnerability warning-the black bar safety net

For domestic and foreign a lot of news, BBS and e-Commerce site using ASP+SQL design, and write an ASP programmer many many have just graduated, so, ASP+SQL attack success rate is relatively high. This type of attack method with the NT version and SQL version is not much relationship, there is no...

CVE-2006-6757

Directory traversal vulnerability in index.php in cwmExplorer 1.0 allows remote attackers to read arbitrary files and source code, and obtain sensitive information via directory traversal sequences in the showfile parameter...

Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scrip...