Piwik ofc_upload_image.php远程PHP代码执行漏洞

BUGTRAQ ID: 37314 CVECAN ID: CVE-2009-4140 Piwik是一款利用Php+MySQL技术构建的开源网页访问统计系统。 Piwik中使用了open-flash-chart模块执行制表操作，该模块没有正确的过滤提交给ofcuploadimage.php文件的name和HTTPRAWPOSTDATA参数便用于创建文件： ? $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination =...

Sql injection

SQL injection vulnerability in user.php in Super Serious Stats aka superseriousstats before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an "incorrect regexp." NOTE: some of these details are obtained from third party information...

CVE-2009-3961

SQL injection vulnerability in user.php in Super Serious Stats aka superseriousstats before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an "incorrect regexp." NOTE: some of these details are obtained from third party information...

CVE-2009-3961

The CVE-2009-3961 entry describes an SQL injection in Super Serious Stats (aka superseriousstats) through user.php, exploitable via the uid parameter and related to an "incorrect regexp." The vulnerability affects versions before 1.1.2p1 and could allow remote attackers to execute arbitrary SQL c...

CVE-2009-3961

SQL injection vulnerability in user.php in Super Serious Stats aka superseriousstats before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an "incorrect regexp." NOTE: some of these details are obtained from third party information...

kernel security and bug fix update

2.6.9-89.0.15.0.1.EL - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - backout patch sysrq-b that queues upto keventd thread Guru Anbalagane orabug 6125546 - netrx/netpoll race...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via 1 ftp/index.php, 2 viewer.php, 3 functions/other.php, 4 include/leftmenu.class.php, or 5 plugins/stats/statsview.php...

CVE-2009-2602

R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb...

Directory traversal

Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. dot dot in the domain parameter...

Mandrake Security Advisory MDVSA-2009:105 (memcached)

The remote host is missing an update to memcached announced via advisory MDVSA-2009:105. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

CVE-2009-1494

The processstat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port...

CVE-2009-1494

The processstat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port...

DEBIAN-CVE-2009-1494

The processstat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port...

DEBIAN-CVE-2009-1255

The processstat function in 1 Memcached before 1.2.8 and 2 MemcacheDB 1.2.0 discloses a the contents of /proc/self/maps in response to a stats maps command and b memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such ...

memcached -- memcached stats maps Information Disclosure Weakness

Secunia reports: A weakness has been reported in memcached, which can be exploited by malicious people to disclose system information. The weakness is caused due to the application disclosing the content of /proc/self/maps if a stats maps command is received. This can be exploited to disclose e.g...

Sql injection

Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via 1 the loginname parameter aka the username field or 2 the loginpw parameter aka the password field...

CVE-2009-1347

Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via 1 the loginname parameter aka the username field or 2 the loginpw parameter aka the password field...

CVE-2009-1347

The CVE-2009-1347 entry describes multiple SQL injection vulnerabilities in stats/index.php of chCounter 3.1.3, allowing remote attackers to execute arbitrary SQL commands through the login_name (username) or login_pw (password) parameters. This affects the application’s authentication/input hand...

CVE-2009-1224

SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attackers to execute arbitrary SQL commands via the gameID parameter...

CVE-2009-1224

CVE-2009-1224 involves a SQL injection in vsp-core/pub/themes/bismarck/gamestat.php within the vsp stats processor version 0.45. The underlying issue is improper sanitization of the gameID parameter, allowing remote attackers to execute arbitrary SQL commands. The connected documents confirm the ...