Apache suEXEC Privilege Elevation / Information Disclosure

Apache suEXEC suffers from privilege escalation and information disclosure vulnerabilities. Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the...

Apache suEXEC - Information Disclosure Privilege Escalation

Apache suEXEC - Information Disclosure Privilege Escalation Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web...

Apache suEXEC - Information Disclosure / Privilege Escalation

Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web server. Normally, when a CGI or SSI program executes, it runs as...

[Netsparker v3.0.2.0 Community Edition] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

MotoCMS 1.3.3 Password File Disclosure / Shell Upload

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

DEBIAN-CVE-2009-5067

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. dot dot in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a...

CVE-2009-5067

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. dot dot in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a...

Directory traversal

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. dot dot in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a...

CVE-2009-5067

CVE-2009-5067 refers to a directory-traversal vulnerability in html2ps prior to 1.0b6, exploitable via an SSI include file directive to read arbitrary files. Public details in connected docs confirm the issue affects html2ps and note a fix shipped in 1.0b7 (Mandriva MDVSA-2013:041) with updated p...

CVE-2009-5067

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. dot dot in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a...

CVE-2009-5067

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. dot dot in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a...

Winamp 5.5.8.2985 (in_mod plugin) Stack Overflow (Friendly Version)

Exploit for windows platform in category local exploits =================================================================== Winamp 5.5.8.2985 inmod plugin Stack Overflow Friendly Version =================================================================== !/usr/bin/python Winamp 5.5.8.2985 inmod...

Winamp 5.5.8.2985 (in_mod plugin) - Local Stack Overflow

!/usr/bin/python Pwn And Beans by Mighty-D and 7eK presents: Winamp 5.5.8.2985 inmod plugin Stack Overflow A Script Kiddie Friendly Production WINDOWS XP SP3 FULLY PATCHED - NO ASLR OR DEP BYPASS... yet Bug found by http://www.exploit-db.com/exploits/15248/ An improvement to...

The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit)

$Id: guestbookssiexec.rb 9671 2010-07-03 06:21:31Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Httpdx v1.5.3 Remote Break Server HTTP

Exploit for windows platform in category dos / poc ====================================================================== httpdx v1.5.3 PNG File Handling Remote Denial of Service Vulnerability ====================================================================== Vulnerable: httpdx httpdx 1.5.3...

When the website does not allow upload ASP,CGI,CER,CDX,HTR and other types of files-bug warning-the black bar safety net

Method:Upload a shtm file, content is:!-- include file="conn. asp" - A direct request to the shtm file,conn. asp is unobstructed, the database path is also on hand. Parsing:!-- include file="conn. asp" - is an SSI Directive,its role is the"conn. asp"to copy the contents to the current page,when a...

CGI Generic SSI Injection (HTTP headers)

The remote web server hosts one or more CGI scripts that fail to adequately sanitize request strings and seem to be vulnerable to an 'SSI injection' attack. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network...

Matt Wright guestbook.pl Arbitrary Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Matt Wright...

CGI Generic SSI Injection

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. They seem to be vulnerable to an 'SSI injection' attack. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, In...

html2ps 'include file' SSI指示目录遍历漏洞

Bugraq ID: 36523 html2ps是一款能够把带有图片，复杂表格包含rowspan/colspan，layer/div和css样式的HTML转换成Postscript与PDF的工具。 html2ps使用的"include file" ssi指示没有检查目录遍历，因此攻击者可以包含和泄漏目录树中的任意文件，此漏洞需要html2psrc文件中@html2ps块的"ssi"设置为1，这个设置是默认配置。 html2ps html2ps 1.0 b5 + S.u.S.E. Linux 8.1 + S.u.S.E. Linux 8.0 i386 + S.u.S.E. Linux 8....