Sun/Oracle GlassFish Server Authenticated Code Execution

$Id: glassfishdeployer.rb 13485 2011-08-04 17:36:01Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Debian Security Advisory DSA 2266-1 (php5)

The remote host is missing an update to php5 announced via advisory DSA 2266-1. OpenVAS Vulnerability Test $Id: deb22661.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2266-1 php5 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Zero-day flaw in WordPress image utility allows to upload files and execute codes

Zero-day flaw in WordPress image utility allows to upload files and execute codes Mark Maunder, CEO of Seattle-based technology firm Feedjit, discovered the flaw after his own blog was hacked to load advertising content. He ended up tracing the issue back to TimThumb, which he uses on his blog...

Debian DSA-2266-1 : php5 - several vulnerabilities

Several vulnerabilities were discovered in PHP, which could lead to denial of service or potentially the execution of arbitrary code. - CVE-2010-2531 An information leak was found in the varexport function. - CVE-2011-0421 The Zip module could crash. - CVE-2011-0708 An integer overflow was...

[SECURITY] [DSA 2266-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2266-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 29, 2011 http://www.debian.org/security/faq -...

DSA-2266-1 php5 - several

Bulletin has no description...

CVE-2011-1409

Frams's Fast File EXchange FEX, aka fex 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID...

CVE-2011-1409

Frams's Fast File EXchange FEX, aka fex 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID...

Code injection

WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file...

Drupal With Webform Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability Report Original Date of Vendor Notification: April 19, 2011 15:15 GMT - 4:00 Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The...

CMS Balitbang 3.42 Fckeditor Arbitrary File Uploads Exploit

Exploit for php platform in category web applications Author : thecybernuxbie Home : www.nuxbie.zuzzeta.us E-mail : email protected Found : 06 April 2011. Version: CMS Balitbang 3.42. Tested : Windows 7 Ultimate 32bit. Link : http://www.kajianwebsite.org/download/CMS%203.42-17082010.rar ! Dork :...

Ubuntu Update for python-django vulnerabilities USN-1066-1

Ubuntu Update for Linux kernel vulnerabilities USN-1066-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10661.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for python-django vulnerabilities USN-1066-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

USN-1066-1: Django vulnerabilities

It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery CSRF attacks. CVE-2011-0696 It was discovered that Django did not properly sanitize its input when...

Fedora Update for perl-CGI FEDORA-2011-0640

Check for the Version of perl-CGI OpenVAS Vulnerability Test Fedora Update for perl-CGI FEDORA-2011-0640 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] Fedora 14 Update: perl-CGI-3.51-1.fc14

CGI.pm is a stable, complete and mature solution for processing and prepari ng HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string genera tion and manipulation, and processing and preparing HTTP headers. Some...

[SECURITY] Fedora 13 Update: perl-CGI-3.51-1.fc13

CGI.pm is a stable, complete and mature solution for processing and prepari ng HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string genera tion and manipulation, and processing and preparing HTTP headers. Some...

Fedora 14 : proftpd-1.3.3d-1.fc14 (2011-0610)

This is an update to the current upstream maintenance release, which addresses a security issue that could affect users of the modsql module not enabled by default. - A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the...

Fedora 13 : proftpd-1.3.3d-1.fc13 (2011-0613)

This is an update to the current upstream maintenance release, which addresses a security issue that could affect users of the modsql module not enabled by default. - A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the...

Lomtec ActiveWeb Professional 3.0 CMS allows arbitrary file upload and execution

Overview Lomtec ActiveWeb Professional 3.0 web content management server allows unauthenticated users to upload arbitrary files. Description According to Lomtec's website: "Lomtec ActiveWeb offers an ideal solution for the creation, maintenance and administration of a Web site and its content. "...

CVE-2010-3600

Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was...