Insufficient output sanitizing when generating configuration file.

PMASA-2010-4 Announcement-ID: PMASA-2010-4 Date: 2010-08-20 Summary Insufficient output sanitizing when generating configuration file. Description The setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration...

HP Mercury LoadRunner Agent Trusted Input Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Mercury LoadRunner. Authentication is not required to exploit this vulnerability. The specific flaw exists within the process magentproc.exe that binds to TCP port 54345. A specially crafted...

BakBone NetVault Messages Buffer Overflow (CVE-2005-1009)

NetVault is a multi-platform backup and restore software suite produced by BakBone Software. The product uses a client-server architecture and is capable of networked backup tasks. The product has separate network communication mechanisms to facilitate backup and management functions. The client...

[ISecAuditors Security Advisories] PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability

============================================= INTERNET SECURITY AUDITORS ALERT 2009-011 - Original release date: October 13th, 2009 - Last revised: December 18th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3702 - Severity: 8.5/10 CVSS Base Score...

PHP-Calendar 1.1 Remote/Local File Inclusion

============================================= INTERNET SECURITY AUDITORS ALERT 2009-011 - Original release date: October 13th, 2009 - Last revised: December 18th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3702 - Severity: 8.5/10 CVSS Base Score...

Zabbix < 1.6.8 Multiple Vulnerabilities

Binary data 5270.prm...

Graffiti CMS 1.x Arbitrary File Upload Vulnerability

No description provided by source. Graffiti CMS includes a file manager component that allows unauthenticated users to upload files including asp.net pages which allow code execution. All versions are affected by this vulnerability. To exploit this issue, it only suffices to access to the followi...

Graffiti CMS 1.x - Arbitrary File Upload

Graffiti CMS 1.x - Arbitrary File Upload Graffiti CMS includes a file manager component that allows unauthenticated users to upload files including asp.net pages which allow code execution. All versions are affected by this vulnerability. To exploit this issue, it only suffices to access to the...

Graffiti CMS 1.x Arbitrary File Upload Vulnerability

Exploit for unknown platform in category web applications ==================================================== Graffiti CMS 1.x Arbitrary File Upload Vulnerability ==================================================== Graffiti CMS includes a file manager component that allows unauthenticated users...

Mandriva Linux Security Advisory : pulseaudio (MDVSA-2008:065)

Luigi Auriemma found a few programming errors in Pulseaudio, that can be used to crash the Pulseaudio daemon, by authenticated and unauthenticated users. The updated packages fix these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

phpmyadmin -- insufficient output sanitizing when generating configuration file

phpMyAdmin Team reports: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. This...

3Com OfficeConnect Wireless CableDSL Router - Authentication Bypass

3Com OfficeConnect Wireless CableDSL Router - Authentication Bypass ==================================================== 3Com OfficeConnect Wireless Cable/DSL Router Authentication Bypass Original Advisory: http://www.ikkisoft.com/stuff/LC-2008-05.txt luca.carettoniatikkisoftdotcom...

TCL Shell (tclsh) Arbitrary Command Execution

A TCL shell tclsh is running on this port, and it allows unauthenticated users to run arbitrary commands on the machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid35308; scriptversion"1.14";...

CVE-2008-5673

PHParanoid before 0.4 does not properly restrict access to the members area by unauthenticated users, which has unknown impact and remote attack vectors...

Microsoft Host Integration Server SNA RPC authentication bypass

Added: 10/15/2008 CVE: CVE-2008-3466 BID: 31620 OSVDB: 49068 Background Microsoft Host Integration Server is an enabling technology which allows integration of applications and data with new Windows solutions. Problem A vulnerability in Microsoft Host Integration Server allows remote...

Gentoo Security Advisory GLSA 200707-11 (mit-krb5)

The remote host is missing updates announced in advisory GLSA 200707-11. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2008-3745

The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors...

Cisco CiscoWorks Internetwork Performance Monitor Remote Command Execution

Binary data ciscoworksipm.nbin...

Cisco Security Advisory: Cisco IOS Secure Shell Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Secure Shell Denial of Service Vulnerabilities Advisory ID: cisco-sa-20080521-ssh http://www.cisco.com/warp/public/707/cisco-sa-20080521-ssh.shtml Revision 1.0 For Public Release 2008 May 21 1600 UTC GMT...

Cisco IOS Secure Shell Denial of Service Vulnerabilities

The Secure Shell server SSH implementation in Cisco IOS contains multiple vulnerabilities that allow unauthenticated users the ability to generate a spurious memory access error or, in certain cases, reload the device. The IOS SSH server is an optional service that is disabled by default, but its...