vBShout is vulnerable to a stored XSS vulnerability. An attacker can inject malicious JavaScript code into the application by adding a malicious hash tag in the Custom Commands page. This code will be executed when a user visits the page.
Advanced User Tagging vBulletin is vulnerable to a stored XSS vulnerability. An attacker can inject malicious JavaScript code into the 'Hash Tag Subscriptions' page, which is accessible via the UserCP. When a user visits the page, the malicious code will be executed in the user's browser.
A denial of service vulnerability exists in Jolix Media Player version 1.1.0. An attacker can create a specially crafted .m3u file containing 1000 'A' characters, which when opened in Jolix Media Player will cause a denial of service condition.
It is possible to execute Denial of Service attacks on Apache CXF, exploiting the fact that the streaming XML parser does not put limits on things like the number of elements, number of attributes, the nested structure of the document received, etc. The effects of these attacks can vary from causing high CPU usage, to causig the JVM to run out of memory.
If the system administrator is updating the system using update manager or smpatch (multi user mode) a local user could execute commands as root. This only affects x86 systems as this code resides under a case statement checking that the platform is intel based. Local root can be achieved by writing to /tmp/diskette_rc.d/rcs9.sh before execution and executing commands as root. Injecting entries into driver_aliases and researching config file can also be used to load own library/driver.
This exploit works because adding modules can be done without any sort of authentication. By simply setting the module filepath to "../../../../../../../../../../../var/log/ona.log" (add or remove dots at will) we can include the log file as a module. Where it gets clever is remember the description is logged! So we can add PHP code into the description and thus the logs and it will be executed on inclusion of this file! The PHP interpreter will ignore everything not enclosed in PHP tags so it will only run the code we inject. This is basically a spin off of Apache log injection exploitation. Once the module has been added all you have to do is run it via "dcm.php?module=". This all works without any guest account etc.
The vulnerability is caused by missing input validation in different XML parameters. This vulnerability could be exploited to inject and execute arbitrary shell commands. On different devices wget is preinstalled and you are able to upload and execute your malicious binary.
Input passed via 'group' HTTP GET parameter to '/www/admin/plugin-preferences.php' and '/www/admin/plugin-settings.php' scripts is not properly verified before being used in PHP 'include()' function and can be exploited to include arbitrary local files via directory traversal sequences and URL-encoded NULL byte techniques.
This module exploits an arbitrary php command execution vulnerability, because of a dangerous use of eval(), in InstantCMS versions 1.6.
A buffer overflow vulnerability exists in Realtek Sound Manager AvRack due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted .wav file to the vulnerable application. This can result in arbitrary code execution in the context of the application.
Services By CQR