Discuz space. php injection vulnerability analysis-vulnerability warning-the black bar safety net

$member = $db-fetchfirst"SELECT m., mf., u. grouptitle, u. type, u. creditshigher, u. creditslower, u. readaccess, u. color AS groupcolor, u. stars AS groupstars, u. allownickname, u. allowuseblog, r. ranktitle, r. color AS rankcolor, r. stars AS rankstars $oltimeadd1 FROM $tablepremembers m LEFT...

[SECURITY] Fedora 9 Update: python-formencode-1.0.1-1.fc9

FormEncode validates and converts nested structures. It allows for a declarative form of defining the validation, and decoupled processes for filling and generating forms...

Linux Kernel sys32_ptrace()函数多个释放后使用漏洞

CVECAN ID: CVE-2008-3077 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux kernel的arch/x86/kernel/ptrace.c文件中的sys32ptrace函数可能会溢出taskstruct结构的refcount字段，本地攻击者可以在x86-64平台上利用这个漏洞触发释放后使用，导致系统崩溃。 Linux kernel 2.6.25.10 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Microsoft SQL Server磁盘数据结构整数溢出漏洞（MS08-040）

BUGTRAQ ID: 30119 CVECAN ID: CVE-2008-0107 Microsoft SQL Server是一款流行的SQL数据库系统。 SQL Server负责解析存储备份数据的代码存在漏洞，该段代码从文件获得了代表记录大小的32位整数值用于计算所要读取到堆缓冲区的字节数。这个计算可能下溢，导致分配不充分的内存，之后的操作会触发溢出。 如果要利用这个漏洞，攻击者必须能够诱骗服务器加载特制的备份文件，可通过提交到远程文件的路径或使用SMB/WebDAV来实现。 Microsoft SQL Server 7.0 SP4 Microsoft SQL Server 2005...

Drupal Outline Designer Module 'outline_designer.module'安全绕过漏洞

BUGTRAQ ID: 30066 CNCAN ID：CNCAN-2008070703 Drupal Outline Designer是一款提供书目中可视的内容结构。 Drupal Outline Designer存在设计错误，远程攻击者可以利用漏洞获得对限制用户的内容查看。 目前没有详细漏洞细节提供。 Drupal Outline designer 5.x-1.3 升级到最新版本： http://drupal.org/node/277851...

[SECURITY] Fedora 8 Update: glib2-2.14.6-2.fc8

GLib is the low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system. This package provides versi...

CVE-2008-2826

Integer overflow in the sctpgetsockoptlocaladdrsold function in net/sctp/socket.c in the Stream Control Transmission Protocol sctp functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service resource consumption and system outage via vectors involving a large...

Microsoft Windows WINS service local elevation of privilege vulnerability-vulnerability warning-the black bar safety net

Source: IT Lab Microsoft Windows is Microsoft released the very popularoperating system. In Windows, the WINS service does not adequately validate specially crafted WINS network packets within the data structure, may allow a local attacker to use elevated permissions to run the code. Release date...

sitexscms-traverserfi.txt

siteXS CMS 0.1.1 Directory Traversal Vulnerability,Arbitrary File Upload,Remote File Include Discovered by: e.wiZz! Site: madspot.org Mail: N/A :D Info: Thanks to ourBosnian presidentswe have 3,eh for stealing our money,so we dont have anythin' to eat. cheers In the wild....... / INTRO / Info:...

CVE-2008-2363

The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow...

New release of MySQL fixes security bugs

MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure...

subedit-poc.txt

/===Subedit Player build 4066 subtitle BoF vulnerability=========| | | SubEdit Player is a very popular player and subtitles | editor in Poland. It does not perform any boundery checks | on supplied subtitles. This causes buffer overrun and | throwing access violation exception on group of...

SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)

SubEdit Player build 4066 - subtitle Buffer Overflow PoC /===Subedit Player build 4066 subtitle BoF vulnerability=========| | | SubEdit Player is a very popular player and subtitles | editor in Poland. It does not perform any boundery checks | on supplied subtitles. This causes buffer overrun and...

SubEdit Player build 4066 subtitle Buffer Overflow PoC

Exploit for unknown platform in category dos / poc ====================================================== SubEdit Player build 4066 subtitle Buffer Overflow PoC ====================================================== /===Subedit Player build 4066 subtitle BoF vulnerability=========| | | SubEdit...

SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)

/===Subedit Player build 4066 subtitle BoF vulnerability=========| | | SubEdit Player is a very popular player and subtitles | editor in Poland. It does not perform any boundery checks | on supplied subtitles. This causes buffer overrun and | throwing access violation exception on group of...

libfishsound: insufficient boundary checks

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure...

CVE-2008-1686

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure...

CVE-2008-1686

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure...

CVE-2008-1686

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure...

libxine -- array index vulnerability

xine Team reports: A new xine-lib version is now available. This release contains a security fix an unchecked array index that could allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer...