Sql injection

PHP before 5.3.10 does not properly perform a temporary change to the magicquotesgpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/phpvariables.c, sapi/cgi/cgimain.c, and...

CVE-2012-0831

PHP before 5.3.10 does not properly perform a temporary change to the magicquotesgpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/phpvariables.c, sapi/cgi/cgimain.c, and...

PT-2012-2893 · Php +3 · Php +3

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.3.10 Description: The issue makes it easier for remote attackers to conduct SQL injection attacks via a crafted request. This is related to the improper handling of the magic quotes gpc directive during the importing o...

PHP < 5.3.10 Security Bypass Vulnerability - Windows

PHP is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

CVE-2012-0830

The CVE-2012-0830 entry documents a memory corruption/remote code execution issue in PHP 5.3.9 related to an incorrect fix for CVE-2011-4885, caused by improper handling of a large number of input variables in php_register_variable_ex() within PHP’s php_variables.c. The vulnerability permits a re...

CVE-2012-0830

The phpregistervariableex function in phpvariables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885...

CVE-2012-0830

The phpregistervariableex function in phpvariables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885...

php: remote code exec flaw introduced in the CVE-2011-4885 hashdos fix

The phpregistervariableex function in phpvariables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885...

CVE-2012-0831

PHP before 5.3.10 does not properly perform a temporary change to the magicquotesgpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/phpvariables.c, sapi/cgi/cgimain.c, and...

Information disclosure

EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors...

CVE-2011-4143

EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors...

CVE-2011-4143

EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors...

CVE-2011-4143

Summary of CVE-2011-4143 : Affected product is RSA enVision 4.x (4.0 SP4 P5 and 4.1 before P3). The issue is an environmental variable information disclosure vulnerability that could allow an unauthenticated, remote attacker to obtain sensitive details about the environment variables in the web s...

Webcalendar 1.2.4 Cross Site Scripting

Exploit Title: Webcalendar 1.2.4 'location' XSS Date: 01/11/12 Author: G13 Software Link: https://sourceforge.net/projects/webcalendar/?source=directory Version: 1.2.5 Category: webapps php Vulnerability There is no sanitation on the input of the location variable. This allows malicious scripts t...

Winn Guestbook v2.4.8c Stored XSS

Exploit Title: Winn Guestbook v2.4.8c Stored XSS Date: 12/29/11 Author: G13 Software Link: http://code.google.com/p/winn-guestbook/, http://www.winn.ws Version: 2.4.8c Category: webapps php CVE: 2011-5026 Vulnerability There is no sanitation on the input of the name variable. This allows maliciou...

CVE-2011-1710

Multiple integer overflows in the HTTP server in the Novell XTier framework 3.1.8 allow remote attackers to cause a denial of service service crash or possibly execute arbitrary code via crafted header length variables...

DIY-CMS blog mod SQL Injection

Exploit for php platform in category web applications Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: email protected Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

DIY-CMS blog mod - SQL Injection

DIY-CMS blog mod - SQL Injection Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

DIY-CMS Blog Mod SQL Injection

Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG: http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=sqli...

Debian DSA-2348-1 : systemtap - several vulnerabilities

Several vulnerabilities were discovered in SystemTap, an instrumentation system for Linux : - CVE-2011-2503 It was discovered that a race condition in staprun could lead to privilege escalation. - CVE-2010-4170 It was discovered that insufficient validation of environment variables in staprun cou...